From e92c44f7f1655162fe0fbdfdc83c848207650c6a Mon Sep 17 00:00:00 2001
From: kjuulh <contact@kjuulh.io>
Date: Sun, 8 May 2022 20:27:01 +0200
Subject: [PATCH] Fix state

---
 main.tf                   |   43 +-
 modules/flux/main.tf      |   24 +-
 modules/flux/providers.tf |    2 +-
 modules/flux/variables.tf |   11 +
 terraform.tfstate         |  363 +++++++++--
 terraform.tfstate.backup  | 1230 ++++++++++++++++++++++++++++++++++++-
 6 files changed, 1596 insertions(+), 77 deletions(-)

diff --git a/main.tf b/main.tf
index db747a2..a5d81ed 100644
--- a/main.tf
+++ b/main.tf
@@ -61,7 +61,7 @@ module "kube-hetzner" {
       taints = [
         "server-usage=storage:NoSchedule"
       ],
-      count = 1
+      count = 2
     }
   ]
 
@@ -76,24 +76,24 @@ module "kube-hetzner" {
 
   # Adding extra firewall rules, like opening a port
   # More info on the format here https://registry.terraform.io/providers/hetznercloud/hcloud/latest/docs/resources/firewall
-  # extra_firewall_rules = [
-  #   # For Postgres
-  #   {
-  #     direction       = "in"
-  #     protocol        = "tcp"
-  #     port            = "5432"
-  #     source_ips      = ["0.0.0.0/0", "::/0"]
-  #     destination_ips = [] # Won't be used for this rule 
-  #   },
-  #   # To Allow ArgoCD access to resources via SSH
-  #   {
-  #     direction       = "out"
-  #     protocol        = "tcp"
-  #     port            = "22"
-  #     source_ips      = [] # Won't be used for this rule 
-  #     destination_ips = ["0.0.0.0/0", "::/0"]
-  #   }
-  # ]
+  extra_firewall_rules = [
+    #   # For Postgres
+    #   {
+    #     direction       = "in"
+    #     protocol        = "tcp"
+    #     port            = "5432"
+    #     source_ips      = ["0.0.0.0/0", "::/0"]
+    #     destination_ips = [] # Won't be used for this rule 
+    #   },
+    #   # To Allow ArgoCD access to resources via SSH
+    {
+      direction       = "out"
+      protocol        = "tcp"
+      port            = "22"
+      source_ips      = [] # Won't be used for this rule 
+      destination_ips = ["0.0.0.0/0", "::/0"]
+    }
+  ]
 
   # If you want to configure additional Arguments for traefik, enter them here as a list and in the form of traefik CLI arguments; see https://doc.traefik.io/traefik/reference/static-configuration/cli/
   # Example: traefik_additional_options = ["--log.level=DEBUG", "--tracing=true"]
@@ -124,7 +124,10 @@ module "dns" {
 module "flux" {
   source    = "./modules/flux"
   path      = "clank"
-  namespace = "clank"
+  namespace = "flux-system"
   url       = "ssh://git@git.front.kjuulh.io/clank/kubernetes-state.git"
   branch    = "main"
+
+  ssh_private_key_pem = file(".keys/id_clank")
+  ssh_public_key_pem = file(".keys/id_clank.pub")
 }
diff --git a/modules/flux/main.tf b/modules/flux/main.tf
index e656622..26f5d3f 100644
--- a/modules/flux/main.tf
+++ b/modules/flux/main.tf
@@ -68,6 +68,13 @@ resource "kubectl_manifest" "sync" {
   yaml_body  = each.value
 }
 
+locals {
+  known_hosts = <<EOT
+git.front.kjuulh.io ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGJdO0Tw0e/Fa78g1Xszc4oKaOPbTwl7RTAaGQb0TrV8
+git.front.kjuulh.io ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBO61xoa0ON2Y8rpIB6R9PFxg9HUxMym8Z5I4vYUC+/UnzaDx9YUEGo3Vig9wBo6Hc2lAp0BIwH/d5d6uBBEIj/Y=
+EOT
+}
+
 # Generate a Kubernetes secret with the Git credentials
 resource "kubernetes_secret" "main" {
   depends_on = [kubectl_manifest.apply]
@@ -78,7 +85,20 @@ resource "kubernetes_secret" "main" {
   }
 
   data = {
-    username = "git"
-    password = var.flux_token
+    identity = var.ssh_private_key_pem
+    "identity.pub" = var.ssh_public_key_pem
+    #    identity       = <<EOT
+    #-----BEGIN OPENSSH PRIVATE KEY-----
+    #b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+    #QyNTUxOQAAACBYZYPLAjLRZhUHfk4yTLmiQTDmdWPIgZTI+dGLgpY/GAAAAJgGvLdRBry3
+    #UQAAAAtzc2gtZWQyNTUxOQAAACBYZYPLAjLRZhUHfk4yTLmiQTDmdWPIgZTI+dGLgpY/GA
+    #AAAEBmqJkdSt8H6HIVzV6Na8ukBOj4Bywd970sQVPWAz8Ug1hlg8sCMtFmFQd+TjJMuaJB
+    #MOZ1Y8iBlMj50YuClj8YAAAAEWNvbnRhY3RAa2p1dWxoLmlvAQIDBA==
+    #-----END OPENSSH PRIVATE KEY-----
+    #EOT
+    #    "identity.pub" = <<EOT
+    #ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFhlg8sCMtFmFQd+TjJMuaJBMOZ1Y8iBlMj50YuClj8Y contact@kjuulh.io
+    #EOT
+    known_hosts    = local.known_hosts
   }
 }
diff --git a/modules/flux/providers.tf b/modules/flux/providers.tf
index b1dc3f3..2081fb3 100644
--- a/modules/flux/providers.tf
+++ b/modules/flux/providers.tf
@@ -2,7 +2,7 @@
 terraform {
   required_providers {
     flux = {
-      source = "fluxcd/flux"
+      source  = "fluxcd/flux"
       version = "0.14.1"
     }
     kubectl = {
diff --git a/modules/flux/variables.tf b/modules/flux/variables.tf
index 42d33d4..e88f922 100644
--- a/modules/flux/variables.tf
+++ b/modules/flux/variables.tf
@@ -17,3 +17,14 @@ variable "branch" {
   type     = string
   nullable = false
 }
+
+variable "ssh_private_key_pem" {
+  type     = string
+  nullable = false
+  sensitive = true
+}
+
+variable "ssh_public_key_pem" {
+  type     = string
+  nullable = false
+}
diff --git a/terraform.tfstate b/terraform.tfstate
index 787f3ca..7febe8d 100644
--- a/terraform.tfstate
+++ b/terraform.tfstate
@@ -1,7 +1,7 @@
 {
   "version": 4,
   "terraform_version": "1.1.7",
-  "serial": 90,
+  "serial": 194,
   "lineage": "04d648e3-bdd4-2cef-384a-6564647940db",
   "outputs": {},
   "resources": [
@@ -309,6 +309,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -343,6 +344,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -377,6 +379,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -411,6 +414,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -445,6 +449,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -479,6 +484,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -513,6 +519,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -547,6 +554,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -581,6 +589,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -597,14 +606,14 @@
             "ignore_fields": null,
             "kind": "Deployment",
             "live_manifest_incluster": "e4a3b3bfd6bd6ffd2658edf4addbe86e4de9eb9ed18ac572badad9ac837f4824",
-            "live_uid": "f99f730b-1576-4b2b-a30a-1e199ae2934a",
+            "live_uid": "595c94bd-2897-4105-a6eb-f7f3d28aef31",
             "name": "helm-controller",
             "namespace": "flux-system",
             "override_namespace": null,
             "sensitive_fields": null,
             "server_side_apply": false,
             "timeouts": null,
-            "uid": "f99f730b-1576-4b2b-a30a-1e199ae2934a",
+            "uid": "595c94bd-2897-4105-a6eb-f7f3d28aef31",
             "validate_schema": true,
             "wait": null,
             "wait_for_rollout": true,
@@ -615,6 +624,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -631,14 +641,14 @@
             "ignore_fields": null,
             "kind": "Deployment",
             "live_manifest_incluster": "2826c2c4389823e3aaf89d714a101f295d74b565e99bd2a4d7436ce727817cea",
-            "live_uid": "e96f7550-2bbb-4736-8dd7-7cb071bed832",
+            "live_uid": "7ea37437-55b7-4168-883a-1754bbeccd07",
             "name": "kustomize-controller",
             "namespace": "flux-system",
             "override_namespace": null,
             "sensitive_fields": null,
             "server_side_apply": false,
             "timeouts": null,
-            "uid": "e96f7550-2bbb-4736-8dd7-7cb071bed832",
+            "uid": "7ea37437-55b7-4168-883a-1754bbeccd07",
             "validate_schema": true,
             "wait": null,
             "wait_for_rollout": true,
@@ -649,6 +659,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -665,14 +676,14 @@
             "ignore_fields": null,
             "kind": "Deployment",
             "live_manifest_incluster": "6540cfaf3a1ae420ceb422d5fe5768c84e0297aae12d61c0204ad49d6c7f24c5",
-            "live_uid": "e1270c9d-a52f-44b3-9605-43648d00b976",
+            "live_uid": "240b64d6-e55b-4e86-bdb7-cfd022661d13",
             "name": "notification-controller",
             "namespace": "flux-system",
             "override_namespace": null,
             "sensitive_fields": null,
             "server_side_apply": false,
             "timeouts": null,
-            "uid": "e1270c9d-a52f-44b3-9605-43648d00b976",
+            "uid": "240b64d6-e55b-4e86-bdb7-cfd022661d13",
             "validate_schema": true,
             "wait": null,
             "wait_for_rollout": true,
@@ -683,6 +694,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -699,14 +711,14 @@
             "ignore_fields": null,
             "kind": "Deployment",
             "live_manifest_incluster": "e1aba2209a36f10008a7a3ad79fcfbe50d58900fcb41060ab652fcf6364d6b7f",
-            "live_uid": "2ab81815-bcee-4227-b0a6-14f0a71128d7",
+            "live_uid": "f06006e9-a0d5-492b-bedc-76bd68b508e6",
             "name": "source-controller",
             "namespace": "flux-system",
             "override_namespace": null,
             "sensitive_fields": null,
             "server_side_apply": false,
             "timeouts": null,
-            "uid": "2ab81815-bcee-4227-b0a6-14f0a71128d7",
+            "uid": "f06006e9-a0d5-492b-bedc-76bd68b508e6",
             "validate_schema": true,
             "wait": null,
             "wait_for_rollout": true,
@@ -717,6 +729,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -751,6 +764,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -785,6 +799,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -819,6 +834,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -835,14 +851,14 @@
             "ignore_fields": null,
             "kind": "Namespace",
             "live_manifest_incluster": "36cd74a4c6ef912d14993e6713511346b84b91b559cdcaefa1987bc9820c3340",
-            "live_uid": "6efff1cb-ca2a-425d-a374-3e5298232c28",
+            "live_uid": "0e244da8-b9b0-4053-bf00-7bedb468e182",
             "name": "flux-system",
             "namespace": null,
             "override_namespace": null,
             "sensitive_fields": null,
             "server_side_apply": false,
             "timeouts": null,
-            "uid": "6efff1cb-ca2a-425d-a374-3e5298232c28",
+            "uid": "0e244da8-b9b0-4053-bf00-7bedb468e182",
             "validate_schema": true,
             "wait": null,
             "wait_for_rollout": true,
@@ -853,6 +869,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -869,14 +886,14 @@
             "ignore_fields": null,
             "kind": "Service",
             "live_manifest_incluster": "2bed8e777b97150ef0f8eb7ce6e224b6d4518449b38f9f1dd1f799f187211e33",
-            "live_uid": "17c56462-4b20-4570-b367-53e95d6cda56",
+            "live_uid": "2977a59e-2fd1-4f92-a998-1d95f4a2d1ea",
             "name": "notification-controller",
             "namespace": "flux-system",
             "override_namespace": null,
             "sensitive_fields": null,
             "server_side_apply": false,
             "timeouts": null,
-            "uid": "17c56462-4b20-4570-b367-53e95d6cda56",
+            "uid": "2977a59e-2fd1-4f92-a998-1d95f4a2d1ea",
             "validate_schema": true,
             "wait": null,
             "wait_for_rollout": true,
@@ -887,6 +904,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -903,14 +921,14 @@
             "ignore_fields": null,
             "kind": "Service",
             "live_manifest_incluster": "d56847b2a9516b2994b8bef69ba399ef8afb109c538adbe59446204688e1eae3",
-            "live_uid": "71e09a24-9009-472c-8cd1-41da5c2f559b",
+            "live_uid": "72cd6273-2019-4e1f-868a-485931ba1855",
             "name": "source-controller",
             "namespace": "flux-system",
             "override_namespace": null,
             "sensitive_fields": null,
             "server_side_apply": false,
             "timeouts": null,
-            "uid": "71e09a24-9009-472c-8cd1-41da5c2f559b",
+            "uid": "72cd6273-2019-4e1f-868a-485931ba1855",
             "validate_schema": true,
             "wait": null,
             "wait_for_rollout": true,
@@ -921,6 +939,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -937,14 +956,14 @@
             "ignore_fields": null,
             "kind": "Service",
             "live_manifest_incluster": "32478dcd63b2b822236c495158f3253df5ba5b88831fbeaa2b1198d7a0b472d7",
-            "live_uid": "bd9d4461-afc7-4c45-b090-cf2642dd76a9",
+            "live_uid": "02d74f76-90d5-4da6-90e8-2a51a51d278b",
             "name": "webhook-receiver",
             "namespace": "flux-system",
             "override_namespace": null,
             "sensitive_fields": null,
             "server_side_apply": false,
             "timeouts": null,
-            "uid": "bd9d4461-afc7-4c45-b090-cf2642dd76a9",
+            "uid": "02d74f76-90d5-4da6-90e8-2a51a51d278b",
             "validate_schema": true,
             "wait": null,
             "wait_for_rollout": true,
@@ -955,6 +974,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -971,14 +991,14 @@
             "ignore_fields": null,
             "kind": "ServiceAccount",
             "live_manifest_incluster": "b2aad3f57dca6ad5856d63af0e01b5be04fd424032893aceb9b21bbc92c347a5",
-            "live_uid": "c04ad926-5ba4-4fe8-bca9-ff8643e71f18",
+            "live_uid": "aa9711e9-e81e-439e-a807-abb2e2ab7cfe",
             "name": "helm-controller",
             "namespace": "flux-system",
             "override_namespace": null,
             "sensitive_fields": null,
             "server_side_apply": false,
             "timeouts": null,
-            "uid": "c04ad926-5ba4-4fe8-bca9-ff8643e71f18",
+            "uid": "aa9711e9-e81e-439e-a807-abb2e2ab7cfe",
             "validate_schema": true,
             "wait": null,
             "wait_for_rollout": true,
@@ -989,6 +1009,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -1005,14 +1026,14 @@
             "ignore_fields": null,
             "kind": "ServiceAccount",
             "live_manifest_incluster": "8a14f17da2d09e6c888837953b3962a88d06f405df66028ff154a94d4dfa0d09",
-            "live_uid": "d10373ac-3971-4971-902d-c729903f3a43",
+            "live_uid": "c73c43a2-52f9-42df-bf2b-897016848dda",
             "name": "kustomize-controller",
             "namespace": "flux-system",
             "override_namespace": null,
             "sensitive_fields": null,
             "server_side_apply": false,
             "timeouts": null,
-            "uid": "d10373ac-3971-4971-902d-c729903f3a43",
+            "uid": "c73c43a2-52f9-42df-bf2b-897016848dda",
             "validate_schema": true,
             "wait": null,
             "wait_for_rollout": true,
@@ -1023,6 +1044,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -1039,14 +1061,14 @@
             "ignore_fields": null,
             "kind": "ServiceAccount",
             "live_manifest_incluster": "846badceb5abc1172a04ac98661eded224067c4084bf88be0eb70075af5a53d1",
-            "live_uid": "e5fdb23e-8b89-49e1-af18-a659bc46e585",
+            "live_uid": "743f674e-2fa2-48d1-ae58-36a2354b44ba",
             "name": "notification-controller",
             "namespace": "flux-system",
             "override_namespace": null,
             "sensitive_fields": null,
             "server_side_apply": false,
             "timeouts": null,
-            "uid": "e5fdb23e-8b89-49e1-af18-a659bc46e585",
+            "uid": "743f674e-2fa2-48d1-ae58-36a2354b44ba",
             "validate_schema": true,
             "wait": null,
             "wait_for_rollout": true,
@@ -1057,6 +1079,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -1073,14 +1096,14 @@
             "ignore_fields": null,
             "kind": "ServiceAccount",
             "live_manifest_incluster": "1d5862fdb063737cfa82134235c3dec3144c1c11ac78041a3c187751b6c2ed76",
-            "live_uid": "f4dc0287-a9d2-4e46-b7bc-9fcbe6e0a87a",
+            "live_uid": "2e6d3b1e-37e0-4d53-83a4-65721bef5cbb",
             "name": "source-controller",
             "namespace": "flux-system",
             "override_namespace": null,
             "sensitive_fields": null,
             "server_side_apply": false,
             "timeouts": null,
-            "uid": "f4dc0287-a9d2-4e46-b7bc-9fcbe6e0a87a",
+            "uid": "2e6d3b1e-37e0-4d53-83a4-65721bef5cbb",
             "validate_schema": true,
             "wait": null,
             "wait_for_rollout": true,
@@ -1091,6 +1114,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_install.main",
             "module.flux.data.kubectl_file_documents.apply",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -1116,14 +1140,14 @@
             "ignore_fields": null,
             "kind": "Kustomization",
             "live_manifest_incluster": "76983d95c6d6af709777da0d4f83096cef10b2b6e625b0116db581080e962f87",
-            "live_uid": "92676cb4-aa2b-4a03-8b73-68fcc35a231b",
+            "live_uid": "29dd19f1-dc61-4ad1-97fb-e10e69359515",
             "name": "flux-system",
             "namespace": "flux-system",
             "override_namespace": null,
             "sensitive_fields": null,
             "server_side_apply": false,
             "timeouts": null,
-            "uid": "92676cb4-aa2b-4a03-8b73-68fcc35a231b",
+            "uid": "29dd19f1-dc61-4ad1-97fb-e10e69359515",
             "validate_schema": true,
             "wait": null,
             "wait_for_rollout": true,
@@ -1134,6 +1158,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_sync.main",
             "module.flux.data.kubectl_file_documents.sync",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -1150,14 +1175,14 @@
             "ignore_fields": null,
             "kind": "GitRepository",
             "live_manifest_incluster": "f159fca85740fe805d8ac4569899db00ab9cd9245350a7a56b689eafc490bedb",
-            "live_uid": "717c8ee0-5537-4664-866f-a71f831cd3be",
+            "live_uid": "d2fea749-8f58-4ead-be65-bc2be53cb80e",
             "name": "flux-system",
             "namespace": "flux-system",
             "override_namespace": null,
             "sensitive_fields": null,
             "server_side_apply": false,
             "timeouts": null,
-            "uid": "717c8ee0-5537-4664-866f-a71f831cd3be",
+            "uid": "d2fea749-8f58-4ead-be65-bc2be53cb80e",
             "validate_schema": true,
             "wait": null,
             "wait_for_rollout": true,
@@ -1168,6 +1193,7 @@
           "sensitive_attributes": [],
           "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
           "dependencies": [
+            "module.flux.data.flux_sync.main",
             "module.flux.data.kubectl_file_documents.sync",
             "module.flux.kubernetes_namespace.flux_system"
           ]
@@ -1184,16 +1210,20 @@
         {
           "schema_version": 0,
           "attributes": {
-            "id": "clank",
+            "id": "flux-system",
             "metadata": [
               {
-                "annotations": null,
+                "annotations": {},
                 "generate_name": "",
                 "generation": 0,
-                "labels": null,
-                "name": "clank",
-                "resource_version": "18511",
-                "uid": "e8025c5b-00a7-4b20-9e0b-8215413b8147"
+                "labels": {
+                  "app.kubernetes.io/instance": "flux-system",
+                  "app.kubernetes.io/part-of": "flux",
+                  "app.kubernetes.io/version": "latest"
+                },
+                "name": "flux-system",
+                "resource_version": "36003",
+                "uid": "0e244da8-b9b0-4053-bf00-7bedb468e182"
               }
             ],
             "timeouts": null
@@ -1203,6 +1233,62 @@
         }
       ]
     },
+    {
+      "module": "module.flux",
+      "mode": "managed",
+      "type": "kubernetes_secret",
+      "name": "main",
+      "provider": "module.flux.provider[\"registry.terraform.io/hashicorp/kubernetes\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "binary_data": null,
+            "data": {
+              "identity": "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\nQyNTUxOQAAACBYZYPLAjLRZhUHfk4yTLmiQTDmdWPIgZTI+dGLgpY/GAAAAJgGvLdRBry3\nUQAAAAtzc2gtZWQyNTUxOQAAACBYZYPLAjLRZhUHfk4yTLmiQTDmdWPIgZTI+dGLgpY/GA\nAAAEBmqJkdSt8H6HIVzV6Na8ukBOj4Bywd970sQVPWAz8Ug1hlg8sCMtFmFQd+TjJMuaJB\nMOZ1Y8iBlMj50YuClj8YAAAAEWNvbnRhY3RAa2p1dWxoLmlvAQIDBA==\n-----END OPENSSH PRIVATE KEY-----\n",
+              "identity.pub": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFhlg8sCMtFmFQd+TjJMuaJBMOZ1Y8iBlMj50YuClj8Y contact@kjuulh.io\n",
+              "known_hosts": "git.front.kjuulh.io ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGJdO0Tw0e/Fa78g1Xszc4oKaOPbTwl7RTAaGQb0TrV8\ngit.front.kjuulh.io ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBO61xoa0ON2Y8rpIB6R9PFxg9HUxMym8Z5I4vYUC+/UnzaDx9YUEGo3Vig9wBo6Hc2lAp0BIwH/d5d6uBBEIj/Y=\n"
+            },
+            "id": "flux-system/flux-system",
+            "immutable": false,
+            "metadata": [
+              {
+                "annotations": {},
+                "generate_name": "",
+                "generation": 0,
+                "labels": {},
+                "name": "flux-system",
+                "namespace": "flux-system",
+                "resource_version": "40687",
+                "uid": "e4b26a74-1433-4a38-a126-63f7dec801f0"
+              }
+            ],
+            "type": "Opaque"
+          },
+          "sensitive_attributes": [
+            [
+              {
+                "type": "get_attr",
+                "value": "data"
+              },
+              {
+                "type": "index",
+                "value": {
+                  "value": "identity",
+                  "type": "string"
+                }
+              }
+            ]
+          ],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "module.flux.data.flux_sync.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubectl_manifest.apply"
+          ]
+        }
+      ]
+    },
     {
       "module": "module.kube-hetzner",
       "mode": "data",
@@ -1334,6 +1420,11 @@
             "network_zone": "eu-central",
             "service": null,
             "target": [
+              {
+                "label_selector": "",
+                "server_id": 20289430,
+                "type": "server"
+              },
               {
                 "label_selector": "",
                 "server_id": 20285807,
@@ -1452,12 +1543,27 @@
               {
                 "label_selector": "",
                 "server": 20285811
+              },
+              {
+                "label_selector": "",
+                "server": 20289430
               }
             ],
             "id": "385507",
             "labels": {},
             "name": "clank",
             "rule": [
+              {
+                "description": "",
+                "destination_ips": [
+                  "0.0.0.0/0",
+                  "::/0"
+                ],
+                "direction": "out",
+                "port": "22",
+                "protocol": "tcp",
+                "source_ips": []
+              },
               {
                 "description": "",
                 "destination_ips": [
@@ -1758,7 +1864,8 @@
             "servers": [
               20285807,
               20285809,
-              20285811
+              20285811,
+              20289430
             ],
             "type": "spread"
           },
@@ -1996,6 +2103,37 @@
             "module.kube-hetzner.null_resource.first_control_plane",
             "module.kube-hetzner.random_password.k3s_token"
           ]
+        },
+        {
+          "index_key": "2-1-storage1",
+          "schema_version": 0,
+          "attributes": {
+            "id": "8807962960687335091",
+            "triggers": {
+              "agent_id": "20289430"
+            }
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "module.kube-hetzner.hcloud_firewall.k3s",
+            "module.kube-hetzner.hcloud_network.k3s",
+            "module.kube-hetzner.hcloud_network_subnet.agent",
+            "module.kube-hetzner.hcloud_network_subnet.control_plane",
+            "module.kube-hetzner.hcloud_placement_group.agent",
+            "module.kube-hetzner.hcloud_placement_group.control_plane",
+            "module.kube-hetzner.hcloud_ssh_key.k3s",
+            "module.kube-hetzner.module.agents.data.cloudinit_config.config",
+            "module.kube-hetzner.module.agents.hcloud_server.server",
+            "module.kube-hetzner.module.agents.hcloud_server_network.server",
+            "module.kube-hetzner.module.agents.random_string.server",
+            "module.kube-hetzner.module.control_planes.data.cloudinit_config.config",
+            "module.kube-hetzner.module.control_planes.hcloud_server.server",
+            "module.kube-hetzner.module.control_planes.hcloud_server_network.server",
+            "module.kube-hetzner.module.control_planes.random_string.server",
+            "module.kube-hetzner.null_resource.first_control_plane",
+            "module.kube-hetzner.random_password.k3s_token"
+          ]
         }
       ]
     },
@@ -2680,6 +2818,159 @@
         }
       ]
     },
+    {
+      "module": "module.kube-hetzner.module.agents[\"2-1-storage1\"]",
+      "mode": "data",
+      "type": "cloudinit_config",
+      "name": "config",
+      "provider": "provider[\"registry.terraform.io/hashicorp/cloudinit\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "base64_encode": true,
+            "boundary": "MIMEBOUNDARY",
+            "gzip": true,
+            "id": "4262392169",
+            "part": [
+              {
+                "content": "#cloud-config\n\nwrite_files:\n\n# Configure the private network interface\n- content: |\n    BOOTPROTO='dhcp'\n    STARTMODE='auto'\n  path: /etc/sysconfig/network/ifcfg-eth1\n\n# Disable ssh password authentication\n- content: |\n    PasswordAuthentication no\n    X11Forwarding no\n    MaxAuthTries 2\n    AllowTcpForwarding no\n    AllowAgentForwarding no\n    AuthorizedKeysFile .ssh/authorized_keys\n  path: /etc/ssh/sshd_config.d/kube-hetzner.conf\n\n# Set reboot method as \"kured\"\n- content: |\n    REBOOT_METHOD=kured\n  path: /etc/transactional-update.conf\n\n# Create Rancher repo config\n- content: |\n    [rancher-k3s-common-stable]\n    name=Rancher K3s Common (stable)\n    baseurl=https://rpm.rancher.io/k3s/stable/common/microos/noarch\n    enabled=1\n    gpgcheck=1\n    repo_gpgcheck=0\n    gpgkey=https://rpm.rancher.io/public.key\n  path: /etc/zypp/repos.d/rancher-k3s-common.repo\n\n# Add ssh authorized keys\nssh_authorized_keys:\n  - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOmlyNDEGxQxnXOLGMn80DwjPt+CqCy17UaW9MSBphOy contact@kjuulh.io\n\n# Resize /var, not /, as that's the last partition in MicroOS image.\ngrowpart:\n    devices: [\"/var\"]\n\n# Make sure the hostname is set correctly\nhostname: clank-storage1-cgr\npreserve_hostname: true\n\nruncmd:\n\n# As above, make sure the hostname is not reset\n- [sed, '-i', 's/NETCONFIG_NIS_SETDOMAINNAME=\"yes\"/NETCONFIG_NIS_SETDOMAINNAME=\"no\"/g', /etc/sysconfig/network/config]\n- [sed, '-i', 's/DHCLIENT_SET_HOSTNAME=\"yes\"/DHCLIENT_SET_HOSTNAME=\"no\"/g', /etc/sysconfig/network/dhcp]\n\n# We set Cloudflare DNS servers, followed by Google as a backup\n- [sed, '-i', 's/NETCONFIG_DNS_STATIC_SERVERS=\"\"/NETCONFIG_DNS_STATIC_SERVERS=\"1.1.1.1 1.0.0.1 8.8.8.8\"/g', /etc/sysconfig/network/config]\n\n# Bounds the amount of logs that can survive on the system\n- [sed, '-i', 's/#SystemMaxUse=/SystemMaxUse=3G/g', /etc/systemd/journald.conf]\n- [sed, '-i', 's/#MaxRetentionSec=/MaxRetentionSec=1week/g', /etc/systemd/journald.conf]\n\n# Reduces the default number of snapshots from 2-10 number limit, to 4 and from 4-10 number limit important, to 2\n- [sed, '-i', 's/NUMBER_LIMIT=\"2-10\"/NUMBER_LIMIT=\"4\"/g', /etc/snapper/configs/root]\n- [sed, '-i', 's/NUMBER_LIMIT_IMPORTANT=\"4-10\"/NUMBER_LIMIT_IMPORTANT=\"3\"/g', /etc/snapper/configs/root]\n\n# Disables unneeded services\n- [systemctl, disable, '--now', 'rebootmgr.service']\n",
+                "content_type": "text/cloud-config",
+                "filename": "init.cfg",
+                "merge_type": ""
+              }
+            ],
+            "rendered": "H4sIAAAAAAAA/4xWX2/bPhJ8F5DvsFAefIezpDhp0daFgVNsNzVaWTlbaXtXBAZNriXWEqkjqTgK7sMfSCXNHyfND4YfuDueWc6uVxpLYVCYIGtrHELVlIbXRJmo4tfIPsJaNoIR1Y78ZJZMT9OL+SRe/Nv37Cn4hkpzKYYwCI8OvAMvCB6CDrw77gnXtdTcOCwxhtCiQmE+woaXKEiFI58LbkK6yf37X2WKCL1BFUwFlYyLfAjv1tw8ALiSDV6biJayYQGVYsPzAy/hFe4Vd/gQ43k7xQ2ubAF66HmHMHbxRiGYAqFW/IoYBIFmJ9UWuDCoNoSiFwDt5IfwPw8A4DRNs/NFmqWjHito3XPBZRYvsiSdTEc90hhpgzUxxRAiNDTSre7KiG75I76hmzxAUwxsLROuybpE0LqAmmi9k4oBaUyBwnBKrI/7dZzfAuNHOBDSZX8MBp+k2hFljbwLJuTaojPFUcOxC8VlKXcZrffBLhPnKMwzucYUUvEbZF+w1Z94iRBqXUTkd3y1xVY/cUEX9stWnRchi7bNGoMCzY1AFdqoNWOJBhSupTRQoSkkA6LB3zYKmb/vwmJq+7FKptnndDJyqMeqxk4VodYbUgZNzYjB31pjhbbrCyJogQoU1hJuB2ZP6afqUMH2RAdUVpUUgTa2b5cu7+b6junLiYaxw8DfOtDfHWhNNDaqHBXG1HoYRaquwlvekMtoe6KjDh51ClHFqZJSR0ISRQvHgcIC2GjgTnmd0wLp9vZor7D6HTu6g2yxfUmzbtYlp+EW28fG3bR1HVk6HbJo/+6hTVkPY8bc4N73HlzvtS5WT+Zh6AEEFhwgO377dvAB4jiOxyfzGzIelP+ZzAbzbPrWxmZpVbbzyfTs+l/X4kf69SwR748mu1/n5h/j/47bwbsL8v1Dsjyti7R1jSLU/HP7q2nKIuSurAVqfoMQXRHVByENRH07SKYgpqfdf74k2oDdfW5RAReQWLPTJfCK5Bh6uZI7mx86FxlecYp6CD99S+pfWpWEbBH03RYppDZ2DIBr0GiASqWQmrL17jJDoCUR20AbqUiOg4DmyqsValRXuLpHGdWg56lG0Iq5dRVrIGt5hX2oXpS0t7RUxgvgp0bWh17Ae33o6Wg+zcbp/NPsbDWfLVfLaTZJk3g2n8fJdOS3qP0/I4T0o7zXf2mbdcfLfdnJ5/HX2XSeWb7V53SZPRB8IfeKlF25zvnv6Cwe2yW/KYlCmMyX4HxUug8badcXMli3cCZlXqLtPoE1odum/pNBk/lytczibDZeLaeLb9PFcuT7r+QHofvYR094FA7gfeg+f8k07xBO7UO3G0pSyUYYkBsoZd6NK1AibMOv+BWCFA6mW22w2r/G4dIlEnJ9oXEUPTqdnD0qx2DFol+yUYKUzG3EZxp4mJDrBdo1yKVYIh1FTwODHeL2VWL3h2QNxe6WDDekKQ2IplqjsrfVgtS6kEbDRskKjoPB0V225BU3fTAS3gARrAO8eQoAXtVSGSI66PEzLb5ITqeL1ddZMstGvlXwn8TePGyYIHWN6rZNOlJSmmcMekiwmiXn6SKL55Zqj/5h9uRVofu3Ag2NEIgMmZtuu4NcGc5oaso+sA5oqwqE3NnCugdolavw9je9y733tSA48P4fAAD//909lR4OCgAA"
+          },
+          "sensitive_attributes": []
+        }
+      ]
+    },
+    {
+      "module": "module.kube-hetzner.module.agents[\"2-1-storage1\"]",
+      "mode": "managed",
+      "type": "hcloud_server",
+      "name": "server",
+      "provider": "module.kube-hetzner.provider[\"registry.terraform.io/hetznercloud/hcloud\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "backup_window": "",
+            "backups": false,
+            "datacenter": "fsn1-dc14",
+            "delete_protection": false,
+            "firewall_ids": [
+              385507
+            ],
+            "id": "20289430",
+            "ignore_remote_firewall_ids": false,
+            "image": "ubuntu-20.04",
+            "ipv4_address": "49.12.247.85",
+            "ipv6_address": "2a01:4f8:c012:d246::1",
+            "ipv6_network": "2a01:4f8:c012:d246::/64",
+            "iso": null,
+            "keep_disk": false,
+            "labels": {
+              "engine": "k3s",
+              "provisioner": "terraform"
+            },
+            "location": "fsn1",
+            "name": "clank-storage1-cgr",
+            "network": [],
+            "placement_group_id": 41238,
+            "rebuild_protection": false,
+            "rescue": "linux64",
+            "server_type": "cpx11",
+            "ssh_keys": [
+              "6372775"
+            ],
+            "status": "running",
+            "timeouts": null,
+            "user_data": "1yw8VGJRSEcjXrZpwCMw7s5ae8A="
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo1NDAwMDAwMDAwMDAwfX0=",
+          "dependencies": [
+            "module.kube-hetzner.hcloud_firewall.k3s",
+            "module.kube-hetzner.hcloud_network.k3s",
+            "module.kube-hetzner.hcloud_network_subnet.agent",
+            "module.kube-hetzner.hcloud_placement_group.agent",
+            "module.kube-hetzner.hcloud_ssh_key.k3s",
+            "module.kube-hetzner.module.agents.data.cloudinit_config.config",
+            "module.kube-hetzner.module.agents.random_string.server"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.kube-hetzner.module.agents[\"2-1-storage1\"]",
+      "mode": "managed",
+      "type": "hcloud_server_network",
+      "name": "server",
+      "provider": "module.kube-hetzner.provider[\"registry.terraform.io/hetznercloud/hcloud\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "alias_ips": [],
+            "id": "20289430-1628275",
+            "ip": "10.2.0.102",
+            "mac_address": "86:00:00:0f:27:a2",
+            "network_id": null,
+            "server_id": 20289430,
+            "subnet_id": "1628275-10.2.0.0/16"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "module.kube-hetzner.hcloud_firewall.k3s",
+            "module.kube-hetzner.hcloud_network.k3s",
+            "module.kube-hetzner.hcloud_network_subnet.agent",
+            "module.kube-hetzner.hcloud_placement_group.agent",
+            "module.kube-hetzner.hcloud_ssh_key.k3s",
+            "module.kube-hetzner.module.agents.data.cloudinit_config.config",
+            "module.kube-hetzner.module.agents.hcloud_server.server",
+            "module.kube-hetzner.module.agents.random_string.server"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.kube-hetzner.module.agents[\"2-1-storage1\"]",
+      "mode": "managed",
+      "type": "random_string",
+      "name": "server",
+      "provider": "provider[\"registry.terraform.io/hashicorp/random\"]",
+      "instances": [
+        {
+          "schema_version": 1,
+          "attributes": {
+            "id": "cgr",
+            "keepers": {
+              "name": "clank-storage1"
+            },
+            "length": 3,
+            "lower": true,
+            "min_lower": 0,
+            "min_numeric": 0,
+            "min_special": 0,
+            "min_upper": 0,
+            "number": false,
+            "override_special": null,
+            "result": "cgr",
+            "special": false,
+            "upper": false
+          },
+          "sensitive_attributes": [],
+          "private": "eyJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.kube-hetzner.hcloud_network.k3s",
+            "module.kube-hetzner.hcloud_network_subnet.agent"
+          ]
+        }
+      ]
+    },
     {
       "module": "module.kube-hetzner.module.control_planes[\"0-0-control-plane-fsn1\"]",
       "mode": "data",
diff --git a/terraform.tfstate.backup b/terraform.tfstate.backup
index 76a4349..0fec57b 100644
--- a/terraform.tfstate.backup
+++ b/terraform.tfstate.backup
@@ -1,7 +1,7 @@
 {
   "version": 4,
   "terraform_version": "1.1.7",
-  "serial": 62,
+  "serial": 192,
   "lineage": "04d648e3-bdd4-2cef-384a-6564647940db",
   "outputs": {},
   "resources": [
@@ -157,9 +157,9 @@
           "attributes": {
             "branch": "main",
             "commit": null,
-            "content": "# This manifest was generated by flux. DO NOT EDIT.\n---\napiVersion: source.toolkit.fluxcd.io/v1beta2\nkind: GitRepository\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 1m0s\n  ref:\n    branch: main\n  secretRef:\n    name: flux-system\n  url: ssh://git.front.kjuulh.io/clank/kubernetes-state.git\n---\napiVersion: kustomize.toolkit.fluxcd.io/v1beta2\nkind: Kustomization\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 10m0s\n  path: ./clank\n  prune: true\n  sourceRef:\n    kind: GitRepository\n    name: flux-system\n",
+            "content": "# This manifest was generated by flux. DO NOT EDIT.\n---\napiVersion: source.toolkit.fluxcd.io/v1beta2\nkind: GitRepository\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 1m0s\n  ref:\n    branch: main\n  secretRef:\n    name: flux-system\n  url: ssh://git@git.front.kjuulh.io/clank/kubernetes-state.git\n---\napiVersion: kustomize.toolkit.fluxcd.io/v1beta2\nkind: Kustomization\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 10m0s\n  path: ./clank\n  prune: true\n  sourceRef:\n    kind: GitRepository\n    name: flux-system\n",
             "git_implementation": null,
-            "id": "792eed39ade44e329642df65f9133a283a55ee39c9cf4e08850c59e73e3442ab",
+            "id": "03f8aac88c0386cce28b142e9ea4defd3902a90a0213b8722ce04021876756ee",
             "interval": 1,
             "kustomize_content": "\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n- gotk-sync.yaml\n- gotk-components.yaml\n",
             "kustomize_path": "clank/flux-system/kustomization.yaml",
@@ -172,7 +172,7 @@
             "semver": null,
             "tag": null,
             "target_path": "clank",
-            "url": "ssh://git.front.kjuulh.io/clank/kubernetes-state.git"
+            "url": "ssh://git@git.front.kjuulh.io/clank/kubernetes-state.git"
           },
           "sensitive_attributes": []
         }
@@ -183,7 +183,7 @@
       "mode": "data",
       "type": "kubectl_file_documents",
       "name": "apply",
-      "provider": "provider[\"registry.terraform.io/gavinbunney/kubectl\"]",
+      "provider": "module.flux.provider[\"registry.terraform.io/gavinbunney/kubectl\"]",
       "instances": [
         {
           "schema_version": 0,
@@ -252,20 +252,20 @@
       "mode": "data",
       "type": "kubectl_file_documents",
       "name": "sync",
-      "provider": "provider[\"registry.terraform.io/gavinbunney/kubectl\"]",
+      "provider": "module.flux.provider[\"registry.terraform.io/gavinbunney/kubectl\"]",
       "instances": [
         {
           "schema_version": 0,
           "attributes": {
-            "content": "# This manifest was generated by flux. DO NOT EDIT.\n---\napiVersion: source.toolkit.fluxcd.io/v1beta2\nkind: GitRepository\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 1m0s\n  ref:\n    branch: main\n  secretRef:\n    name: flux-system\n  url: ssh://git.front.kjuulh.io/clank/kubernetes-state.git\n---\napiVersion: kustomize.toolkit.fluxcd.io/v1beta2\nkind: Kustomization\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 10m0s\n  path: ./clank\n  prune: true\n  sourceRef:\n    kind: GitRepository\n    name: flux-system\n",
+            "content": "# This manifest was generated by flux. DO NOT EDIT.\n---\napiVersion: source.toolkit.fluxcd.io/v1beta2\nkind: GitRepository\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 1m0s\n  ref:\n    branch: main\n  secretRef:\n    name: flux-system\n  url: ssh://git@git.front.kjuulh.io/clank/kubernetes-state.git\n---\napiVersion: kustomize.toolkit.fluxcd.io/v1beta2\nkind: Kustomization\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 10m0s\n  path: ./clank\n  prune: true\n  sourceRef:\n    kind: GitRepository\n    name: flux-system\n",
             "documents": [
-              "apiVersion: source.toolkit.fluxcd.io/v1beta2\nkind: GitRepository\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 1m0s\n  ref:\n    branch: main\n  secretRef:\n    name: flux-system\n  url: ssh://git.front.kjuulh.io/clank/kubernetes-state.git",
+              "apiVersion: source.toolkit.fluxcd.io/v1beta2\nkind: GitRepository\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 1m0s\n  ref:\n    branch: main\n  secretRef:\n    name: flux-system\n  url: ssh://git@git.front.kjuulh.io/clank/kubernetes-state.git",
               "apiVersion: kustomize.toolkit.fluxcd.io/v1beta2\nkind: Kustomization\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 10m0s\n  path: ./clank\n  prune: true\n  sourceRef:\n    kind: GitRepository\n    name: flux-system"
             ],
-            "id": "2d3d4dcecad00e5570cf69a040c0ae253fa8bf988bb375ade52a0b458dc38355",
+            "id": "e8997c4e0723aaa03560bc3abf63ef964f956c0fcdf89eb1cbfb760c799cf8d0",
             "manifests": {
               "/apis/kustomize.toolkit.fluxcd.io/v1beta2/namespaces/flux-system/kustomizations/flux-system": "apiVersion: kustomize.toolkit.fluxcd.io/v1beta2\nkind: Kustomization\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 10m0s\n  path: ./clank\n  prune: true\n  sourceRef:\n    kind: GitRepository\n    name: flux-system\n",
-              "/apis/source.toolkit.fluxcd.io/v1beta2/namespaces/flux-system/gitrepositorys/flux-system": "apiVersion: source.toolkit.fluxcd.io/v1beta2\nkind: GitRepository\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 1m0s\n  ref:\n    branch: main\n  secretRef:\n    name: flux-system\n  url: ssh://git.front.kjuulh.io/clank/kubernetes-state.git\n"
+              "/apis/source.toolkit.fluxcd.io/v1beta2/namespaces/flux-system/gitrepositorys/flux-system": "apiVersion: source.toolkit.fluxcd.io/v1beta2\nkind: GitRepository\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 1m0s\n  ref:\n    branch: main\n  secretRef:\n    name: flux-system\n  url: ssh://git@git.front.kjuulh.io/clank/kubernetes-state.git\n"
             }
           },
           "sensitive_attributes": []
@@ -277,16 +277,1005 @@
       "mode": "managed",
       "type": "kubectl_manifest",
       "name": "apply",
-      "provider": "provider[\"registry.terraform.io/gavinbunney/kubectl\"]",
-      "instances": []
+      "provider": "module.flux.provider[\"registry.terraform.io/gavinbunney/kubectl\"]",
+      "instances": [
+        {
+          "index_key": "apiextensions.k8s.io/v1/customresourcedefinition/alerts.notification.toolkit.fluxcd.io",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "apiextensions.k8s.io/v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions/alerts.notification.toolkit.fluxcd.io",
+            "ignore_fields": null,
+            "kind": "CustomResourceDefinition",
+            "live_manifest_incluster": "3eb4be5c0abda78b11086bee7392e6b42d459303662ec0dabdbaf95d67cb3906",
+            "live_uid": "e1ca18e4-5cc9-48ff-98ed-d7f886b6d7c2",
+            "name": "alerts.notification.toolkit.fluxcd.io",
+            "namespace": null,
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "e1ca18e4-5cc9-48ff-98ed-d7f886b6d7c2",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: alerts.notification.toolkit.fluxcd.io\nspec:\n  group: notification.toolkit.fluxcd.io\n  names:\n    kind: Alert\n    listKind: AlertList\n    plural: alerts\n    singular: alert\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v1beta1\n    schema:\n      openAPIV3Schema:\n        description: Alert is the Schema for the alerts API\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: AlertSpec defines an alerting rule for events involving a\n              list of objects\n            properties:\n              eventSeverity:\n                default: info\n                description: Filter events based on severity, defaults to ('info').\n                  If set to 'info' no events will be filtered.\n                enum:\n                - info\n                - error\n                type: string\n              eventSources:\n                description: Filter events based on the involved objects.\n                items:\n                  description: CrossNamespaceObjectReference contains enough information\n                    to let you locate the typed referenced object at cluster level\n                  properties:\n                    apiVersion:\n                      description: API version of the referent\n                      type: string\n                    kind:\n                      description: Kind of the referent\n                      enum:\n                      - Bucket\n                      - GitRepository\n                      - Kustomization\n                      - HelmRelease\n                      - HelmChart\n                      - HelmRepository\n                      - ImageRepository\n                      - ImagePolicy\n                      - ImageUpdateAutomation\n                      type: string\n                    matchLabels:\n                      additionalProperties:\n                        type: string\n                      description: MatchLabels is a map of {key,value} pairs. A single\n                        {key,value} in the matchLabels map is equivalent to an element\n                        of matchExpressions, whose key field is \"key\", the operator\n                        is \"In\", and the values array contains only \"value\". The requirements\n                        are ANDed.\n                      type: object\n                    name:\n                      description: Name of the referent\n                      maxLength: 53\n                      minLength: 1\n                      type: string\n                    namespace:\n                      description: Namespace of the referent\n                      maxLength: 53\n                      minLength: 1\n                      type: string\n                  required:\n                  - name\n                  type: object\n                type: array\n              exclusionList:\n                description: A list of Golang regular expressions to be used for excluding\n                  messages.\n                items:\n                  type: string\n                type: array\n              providerRef:\n                description: Send events using this provider.\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              summary:\n                description: Short description of the impact and affected cluster.\n                type: string\n              suspend:\n                description: This flag tells the controller to suspend subsequent\n                  events dispatching. Defaults to false.\n                type: boolean\n            required:\n            - eventSources\n            - providerRef\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: AlertStatus defines the observed state of Alert\n            properties:\n              conditions:\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation.\n                format: int64\n                type: integer\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []",
+            "yaml_body_parsed": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: alerts.notification.toolkit.fluxcd.io\nspec:\n  group: notification.toolkit.fluxcd.io\n  names:\n    kind: Alert\n    listKind: AlertList\n    plural: alerts\n    singular: alert\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v1beta1\n    schema:\n      openAPIV3Schema:\n        description: Alert is the Schema for the alerts API\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: AlertSpec defines an alerting rule for events involving a\n              list of objects\n            properties:\n              eventSeverity:\n                default: info\n                description: Filter events based on severity, defaults to ('info').\n                  If set to 'info' no events will be filtered.\n                enum:\n                - info\n                - error\n                type: string\n              eventSources:\n                description: Filter events based on the involved objects.\n                items:\n                  description: CrossNamespaceObjectReference contains enough information\n                    to let you locate the typed referenced object at cluster level\n                  properties:\n                    apiVersion:\n                      description: API version of the referent\n                      type: string\n                    kind:\n                      description: Kind of the referent\n                      enum:\n                      - Bucket\n                      - GitRepository\n                      - Kustomization\n                      - HelmRelease\n                      - HelmChart\n                      - HelmRepository\n                      - ImageRepository\n                      - ImagePolicy\n                      - ImageUpdateAutomation\n                      type: string\n                    matchLabels:\n                      additionalProperties:\n                        type: string\n                      description: MatchLabels is a map of {key,value} pairs. A single\n                        {key,value} in the matchLabels map is equivalent to an element\n                        of matchExpressions, whose key field is \"key\", the operator\n                        is \"In\", and the values array contains only \"value\". The requirements\n                        are ANDed.\n                      type: object\n                    name:\n                      description: Name of the referent\n                      maxLength: 53\n                      minLength: 1\n                      type: string\n                    namespace:\n                      description: Namespace of the referent\n                      maxLength: 53\n                      minLength: 1\n                      type: string\n                  required:\n                  - name\n                  type: object\n                type: array\n              exclusionList:\n                description: A list of Golang regular expressions to be used for excluding\n                  messages.\n                items:\n                  type: string\n                type: array\n              providerRef:\n                description: Send events using this provider.\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              summary:\n                description: Short description of the impact and affected cluster.\n                type: string\n              suspend:\n                description: This flag tells the controller to suspend subsequent\n                  events dispatching. Defaults to false.\n                type: boolean\n            required:\n            - eventSources\n            - providerRef\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: AlertStatus defines the observed state of Alert\n            properties:\n              conditions:\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation.\n                format: int64\n                type: integer\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []\n",
+            "yaml_incluster": "3eb4be5c0abda78b11086bee7392e6b42d459303662ec0dabdbaf95d67cb3906"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "apiextensions.k8s.io/v1/customresourcedefinition/buckets.source.toolkit.fluxcd.io",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "apiextensions.k8s.io/v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions/buckets.source.toolkit.fluxcd.io",
+            "ignore_fields": null,
+            "kind": "CustomResourceDefinition",
+            "live_manifest_incluster": "4ec58b70c20cd1a91e0df4e5a9c83429927ab34766e1866beed7a7c7c3b2201c",
+            "live_uid": "0187872f-792e-45df-b75b-b825eb77db20",
+            "name": "buckets.source.toolkit.fluxcd.io",
+            "namespace": null,
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "0187872f-792e-45df-b75b-b825eb77db20",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: buckets.source.toolkit.fluxcd.io\nspec:\n  group: source.toolkit.fluxcd.io\n  names:\n    kind: Bucket\n    listKind: BucketList\n    plural: buckets\n    singular: bucket\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .spec.endpoint\n      name: Endpoint\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    name: v1beta1\n    schema:\n      openAPIV3Schema:\n        description: Bucket is the Schema for the buckets API\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: BucketSpec defines the desired state of an S3 compatible\n              bucket\n            properties:\n              accessFrom:\n                description: AccessFrom defines an Access Control List for allowing\n                  cross-namespace references to this object.\n                properties:\n                  namespaceSelectors:\n                    description: NamespaceSelectors is the list of namespace selectors\n                      to which this ACL applies. Items in this list are evaluated\n                      using a logical OR operation.\n                    items:\n                      description: NamespaceSelector selects the namespaces to which\n                        this ACL applies. An empty map of MatchLabels matches all\n                        namespaces in a cluster.\n                      properties:\n                        matchLabels:\n                          additionalProperties:\n                            type: string\n                          description: MatchLabels is a map of {key,value} pairs.\n                            A single {key,value} in the matchLabels map is equivalent\n                            to an element of matchExpressions, whose key field is\n                            \"key\", the operator is \"In\", and the values array contains\n                            only \"value\". The requirements are ANDed.\n                          type: object\n                      type: object\n                    type: array\n                required:\n                - namespaceSelectors\n                type: object\n              bucketName:\n                description: The bucket name.\n                type: string\n              endpoint:\n                description: The bucket endpoint address.\n                type: string\n              ignore:\n                description: Ignore overrides the set of excluded patterns in the\n                  .sourceignore format (which is the same as .gitignore). If not provided,\n                  a default will be used, consult the documentation for your version\n                  to find out what those are.\n                type: string\n              insecure:\n                description: Insecure allows connecting to a non-TLS S3 HTTP endpoint.\n                type: boolean\n              interval:\n                description: The interval at which to check for bucket updates.\n                type: string\n              provider:\n                default: generic\n                description: The S3 compatible storage provider name, default ('generic').\n                enum:\n                - generic\n                - aws\n                - gcp\n                type: string\n              region:\n                description: The bucket region.\n                type: string\n              secretRef:\n                description: The name of the secret containing authentication credentials\n                  for the Bucket.\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              suspend:\n                description: This flag tells the controller to suspend the reconciliation\n                  of this source.\n                type: boolean\n              timeout:\n                default: 60s\n                description: The timeout for download operations, defaults to 60s.\n                type: string\n            required:\n            - bucketName\n            - endpoint\n            - interval\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: BucketStatus defines the observed state of a bucket\n            properties:\n              artifact:\n                description: Artifact represents the output of the last successful\n                  Bucket sync.\n                properties:\n                  checksum:\n                    description: Checksum is the SHA256 checksum of the artifact.\n                    type: string\n                  lastUpdateTime:\n                    description: LastUpdateTime is the timestamp corresponding to\n                      the last update of this artifact.\n                    format: date-time\n                    type: string\n                  path:\n                    description: Path is the relative file path of this artifact.\n                    type: string\n                  revision:\n                    description: Revision is a human readable identifier traceable\n                      in the origin source system. It can be a Git commit SHA, Git\n                      tag, a Helm index timestamp, a Helm chart version, etc.\n                    type: string\n                  url:\n                    description: URL is the HTTP address of this artifact.\n                    type: string\n                required:\n                - path\n                - url\n                type: object\n              conditions:\n                description: Conditions holds the conditions for the Bucket.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation.\n                format: int64\n                type: integer\n              url:\n                description: URL is the download link for the artifact output of the\n                  last Bucket sync.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: false\n    subresources:\n      status: {}\n  - additionalPrinterColumns:\n    - jsonPath: .spec.endpoint\n      name: Endpoint\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v1beta2\n    schema:\n      openAPIV3Schema:\n        description: Bucket is the Schema for the buckets API.\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: BucketSpec specifies the required configuration to produce\n              an Artifact for an object storage bucket.\n            properties:\n              accessFrom:\n                description: 'AccessFrom specifies an Access Control List for allowing\n                  cross-namespace references to this object. NOTE: Not implemented,\n                  provisional as of https://github.com/fluxcd/flux2/pull/2092'\n                properties:\n                  namespaceSelectors:\n                    description: NamespaceSelectors is the list of namespace selectors\n                      to which this ACL applies. Items in this list are evaluated\n                      using a logical OR operation.\n                    items:\n                      description: NamespaceSelector selects the namespaces to which\n                        this ACL applies. An empty map of MatchLabels matches all\n                        namespaces in a cluster.\n                      properties:\n                        matchLabels:\n                          additionalProperties:\n                            type: string\n                          description: MatchLabels is a map of {key,value} pairs.\n                            A single {key,value} in the matchLabels map is equivalent\n                            to an element of matchExpressions, whose key field is\n                            \"key\", the operator is \"In\", and the values array contains\n                            only \"value\". The requirements are ANDed.\n                          type: object\n                      type: object\n                    type: array\n                required:\n                - namespaceSelectors\n                type: object\n              bucketName:\n                description: BucketName is the name of the object storage bucket.\n                type: string\n              endpoint:\n                description: Endpoint is the object storage address the BucketName\n                  is located at.\n                type: string\n              ignore:\n                description: Ignore overrides the set of excluded patterns in the\n                  .sourceignore format (which is the same as .gitignore). If not provided,\n                  a default will be used, consult the documentation for your version\n                  to find out what those are.\n                type: string\n              insecure:\n                description: Insecure allows connecting to a non-TLS HTTP Endpoint.\n                type: boolean\n              interval:\n                description: Interval at which to check the Endpoint for updates.\n                type: string\n              provider:\n                default: generic\n                description: Provider of the object storage bucket. Defaults to 'generic',\n                  which expects an S3 (API) compatible object storage.\n                enum:\n                - generic\n                - aws\n                - gcp\n                - azure\n                type: string\n              region:\n                description: Region of the Endpoint where the BucketName is located\n                  in.\n                type: string\n              secretRef:\n                description: SecretRef specifies the Secret containing authentication\n                  credentials for the Bucket.\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              suspend:\n                description: Suspend tells the controller to suspend the reconciliation\n                  of this Bucket.\n                type: boolean\n              timeout:\n                default: 60s\n                description: Timeout for fetch operations, defaults to 60s.\n                type: string\n            required:\n            - bucketName\n            - endpoint\n            - interval\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: BucketStatus records the observed state of a Bucket.\n            properties:\n              artifact:\n                description: Artifact represents the last successful Bucket reconciliation.\n                properties:\n                  checksum:\n                    description: Checksum is the SHA256 checksum of the Artifact file.\n                    type: string\n                  lastUpdateTime:\n                    description: LastUpdateTime is the timestamp corresponding to\n                      the last update of the Artifact.\n                    format: date-time\n                    type: string\n                  path:\n                    description: Path is the relative file path of the Artifact. It\n                      can be used to locate the file in the root of the Artifact storage\n                      on the local file system of the controller managing the Source.\n                    type: string\n                  revision:\n                    description: Revision is a human-readable identifier traceable\n                      in the origin source system. It can be a Git commit SHA, Git\n                      tag, a Helm chart version, etc.\n                    type: string\n                  size:\n                    description: Size is the number of bytes in the file.\n                    format: int64\n                    type: integer\n                  url:\n                    description: URL is the HTTP address of the Artifact as exposed\n                      by the controller managing the Source. It can be used to retrieve\n                      the Artifact for consumption, e.g. by another controller applying\n                      the Artifact contents.\n                    type: string\n                required:\n                - path\n                - url\n                type: object\n              conditions:\n                description: Conditions holds the conditions for the Bucket.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation of\n                  the Bucket object.\n                format: int64\n                type: integer\n              url:\n                description: URL is the dynamic fetch link for the latest Artifact.\n                  It is provided on a \"best effort\" basis, and using the precise BucketStatus.Artifact\n                  data is recommended.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []",
+            "yaml_body_parsed": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: buckets.source.toolkit.fluxcd.io\nspec:\n  group: source.toolkit.fluxcd.io\n  names:\n    kind: Bucket\n    listKind: BucketList\n    plural: buckets\n    singular: bucket\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .spec.endpoint\n      name: Endpoint\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    name: v1beta1\n    schema:\n      openAPIV3Schema:\n        description: Bucket is the Schema for the buckets API\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: BucketSpec defines the desired state of an S3 compatible\n              bucket\n            properties:\n              accessFrom:\n                description: AccessFrom defines an Access Control List for allowing\n                  cross-namespace references to this object.\n                properties:\n                  namespaceSelectors:\n                    description: NamespaceSelectors is the list of namespace selectors\n                      to which this ACL applies. Items in this list are evaluated\n                      using a logical OR operation.\n                    items:\n                      description: NamespaceSelector selects the namespaces to which\n                        this ACL applies. An empty map of MatchLabels matches all\n                        namespaces in a cluster.\n                      properties:\n                        matchLabels:\n                          additionalProperties:\n                            type: string\n                          description: MatchLabels is a map of {key,value} pairs.\n                            A single {key,value} in the matchLabels map is equivalent\n                            to an element of matchExpressions, whose key field is\n                            \"key\", the operator is \"In\", and the values array contains\n                            only \"value\". The requirements are ANDed.\n                          type: object\n                      type: object\n                    type: array\n                required:\n                - namespaceSelectors\n                type: object\n              bucketName:\n                description: The bucket name.\n                type: string\n              endpoint:\n                description: The bucket endpoint address.\n                type: string\n              ignore:\n                description: Ignore overrides the set of excluded patterns in the\n                  .sourceignore format (which is the same as .gitignore). If not provided,\n                  a default will be used, consult the documentation for your version\n                  to find out what those are.\n                type: string\n              insecure:\n                description: Insecure allows connecting to a non-TLS S3 HTTP endpoint.\n                type: boolean\n              interval:\n                description: The interval at which to check for bucket updates.\n                type: string\n              provider:\n                default: generic\n                description: The S3 compatible storage provider name, default ('generic').\n                enum:\n                - generic\n                - aws\n                - gcp\n                type: string\n              region:\n                description: The bucket region.\n                type: string\n              secretRef:\n                description: The name of the secret containing authentication credentials\n                  for the Bucket.\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              suspend:\n                description: This flag tells the controller to suspend the reconciliation\n                  of this source.\n                type: boolean\n              timeout:\n                default: 60s\n                description: The timeout for download operations, defaults to 60s.\n                type: string\n            required:\n            - bucketName\n            - endpoint\n            - interval\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: BucketStatus defines the observed state of a bucket\n            properties:\n              artifact:\n                description: Artifact represents the output of the last successful\n                  Bucket sync.\n                properties:\n                  checksum:\n                    description: Checksum is the SHA256 checksum of the artifact.\n                    type: string\n                  lastUpdateTime:\n                    description: LastUpdateTime is the timestamp corresponding to\n                      the last update of this artifact.\n                    format: date-time\n                    type: string\n                  path:\n                    description: Path is the relative file path of this artifact.\n                    type: string\n                  revision:\n                    description: Revision is a human readable identifier traceable\n                      in the origin source system. It can be a Git commit SHA, Git\n                      tag, a Helm index timestamp, a Helm chart version, etc.\n                    type: string\n                  url:\n                    description: URL is the HTTP address of this artifact.\n                    type: string\n                required:\n                - path\n                - url\n                type: object\n              conditions:\n                description: Conditions holds the conditions for the Bucket.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation.\n                format: int64\n                type: integer\n              url:\n                description: URL is the download link for the artifact output of the\n                  last Bucket sync.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: false\n    subresources:\n      status: {}\n  - additionalPrinterColumns:\n    - jsonPath: .spec.endpoint\n      name: Endpoint\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v1beta2\n    schema:\n      openAPIV3Schema:\n        description: Bucket is the Schema for the buckets API.\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: BucketSpec specifies the required configuration to produce\n              an Artifact for an object storage bucket.\n            properties:\n              accessFrom:\n                description: 'AccessFrom specifies an Access Control List for allowing\n                  cross-namespace references to this object. NOTE: Not implemented,\n                  provisional as of https://github.com/fluxcd/flux2/pull/2092'\n                properties:\n                  namespaceSelectors:\n                    description: NamespaceSelectors is the list of namespace selectors\n                      to which this ACL applies. Items in this list are evaluated\n                      using a logical OR operation.\n                    items:\n                      description: NamespaceSelector selects the namespaces to which\n                        this ACL applies. An empty map of MatchLabels matches all\n                        namespaces in a cluster.\n                      properties:\n                        matchLabels:\n                          additionalProperties:\n                            type: string\n                          description: MatchLabels is a map of {key,value} pairs.\n                            A single {key,value} in the matchLabels map is equivalent\n                            to an element of matchExpressions, whose key field is\n                            \"key\", the operator is \"In\", and the values array contains\n                            only \"value\". The requirements are ANDed.\n                          type: object\n                      type: object\n                    type: array\n                required:\n                - namespaceSelectors\n                type: object\n              bucketName:\n                description: BucketName is the name of the object storage bucket.\n                type: string\n              endpoint:\n                description: Endpoint is the object storage address the BucketName\n                  is located at.\n                type: string\n              ignore:\n                description: Ignore overrides the set of excluded patterns in the\n                  .sourceignore format (which is the same as .gitignore). If not provided,\n                  a default will be used, consult the documentation for your version\n                  to find out what those are.\n                type: string\n              insecure:\n                description: Insecure allows connecting to a non-TLS HTTP Endpoint.\n                type: boolean\n              interval:\n                description: Interval at which to check the Endpoint for updates.\n                type: string\n              provider:\n                default: generic\n                description: Provider of the object storage bucket. Defaults to 'generic',\n                  which expects an S3 (API) compatible object storage.\n                enum:\n                - generic\n                - aws\n                - gcp\n                - azure\n                type: string\n              region:\n                description: Region of the Endpoint where the BucketName is located\n                  in.\n                type: string\n              secretRef:\n                description: SecretRef specifies the Secret containing authentication\n                  credentials for the Bucket.\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              suspend:\n                description: Suspend tells the controller to suspend the reconciliation\n                  of this Bucket.\n                type: boolean\n              timeout:\n                default: 60s\n                description: Timeout for fetch operations, defaults to 60s.\n                type: string\n            required:\n            - bucketName\n            - endpoint\n            - interval\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: BucketStatus records the observed state of a Bucket.\n            properties:\n              artifact:\n                description: Artifact represents the last successful Bucket reconciliation.\n                properties:\n                  checksum:\n                    description: Checksum is the SHA256 checksum of the Artifact file.\n                    type: string\n                  lastUpdateTime:\n                    description: LastUpdateTime is the timestamp corresponding to\n                      the last update of the Artifact.\n                    format: date-time\n                    type: string\n                  path:\n                    description: Path is the relative file path of the Artifact. It\n                      can be used to locate the file in the root of the Artifact storage\n                      on the local file system of the controller managing the Source.\n                    type: string\n                  revision:\n                    description: Revision is a human-readable identifier traceable\n                      in the origin source system. It can be a Git commit SHA, Git\n                      tag, a Helm chart version, etc.\n                    type: string\n                  size:\n                    description: Size is the number of bytes in the file.\n                    format: int64\n                    type: integer\n                  url:\n                    description: URL is the HTTP address of the Artifact as exposed\n                      by the controller managing the Source. It can be used to retrieve\n                      the Artifact for consumption, e.g. by another controller applying\n                      the Artifact contents.\n                    type: string\n                required:\n                - path\n                - url\n                type: object\n              conditions:\n                description: Conditions holds the conditions for the Bucket.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation of\n                  the Bucket object.\n                format: int64\n                type: integer\n              url:\n                description: URL is the dynamic fetch link for the latest Artifact.\n                  It is provided on a \"best effort\" basis, and using the precise BucketStatus.Artifact\n                  data is recommended.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []\n",
+            "yaml_incluster": "4ec58b70c20cd1a91e0df4e5a9c83429927ab34766e1866beed7a7c7c3b2201c"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "apiextensions.k8s.io/v1/customresourcedefinition/gitrepositories.source.toolkit.fluxcd.io",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "apiextensions.k8s.io/v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions/gitrepositories.source.toolkit.fluxcd.io",
+            "ignore_fields": null,
+            "kind": "CustomResourceDefinition",
+            "live_manifest_incluster": "ebe9ab24635dab17661e2f41e74bf6f100c9b31f4181530b8146580b6d506d57",
+            "live_uid": "6780b364-265c-4d4a-ac58-348caeb6bff9",
+            "name": "gitrepositories.source.toolkit.fluxcd.io",
+            "namespace": null,
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "6780b364-265c-4d4a-ac58-348caeb6bff9",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: gitrepositories.source.toolkit.fluxcd.io\nspec:\n  group: source.toolkit.fluxcd.io\n  names:\n    kind: GitRepository\n    listKind: GitRepositoryList\n    plural: gitrepositories\n    shortNames:\n    - gitrepo\n    singular: gitrepository\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .spec.url\n      name: URL\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    name: v1beta1\n    schema:\n      openAPIV3Schema:\n        description: GitRepository is the Schema for the gitrepositories API\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: GitRepositorySpec defines the desired state of a Git repository.\n            properties:\n              accessFrom:\n                description: AccessFrom defines an Access Control List for allowing\n                  cross-namespace references to this object.\n                properties:\n                  namespaceSelectors:\n                    description: NamespaceSelectors is the list of namespace selectors\n                      to which this ACL applies. Items in this list are evaluated\n                      using a logical OR operation.\n                    items:\n                      description: NamespaceSelector selects the namespaces to which\n                        this ACL applies. An empty map of MatchLabels matches all\n                        namespaces in a cluster.\n                      properties:\n                        matchLabels:\n                          additionalProperties:\n                            type: string\n                          description: MatchLabels is a map of {key,value} pairs.\n                            A single {key,value} in the matchLabels map is equivalent\n                            to an element of matchExpressions, whose key field is\n                            \"key\", the operator is \"In\", and the values array contains\n                            only \"value\". The requirements are ANDed.\n                          type: object\n                      type: object\n                    type: array\n                required:\n                - namespaceSelectors\n                type: object\n              gitImplementation:\n                default: go-git\n                description: Determines which git client library to use. Defaults\n                  to go-git, valid values are ('go-git', 'libgit2').\n                enum:\n                - go-git\n                - libgit2\n                type: string\n              ignore:\n                description: Ignore overrides the set of excluded patterns in the\n                  .sourceignore format (which is the same as .gitignore). If not provided,\n                  a default will be used, consult the documentation for your version\n                  to find out what those are.\n                type: string\n              include:\n                description: Extra git repositories to map into the repository\n                items:\n                  description: GitRepositoryInclude defines a source with a from and\n                    to path.\n                  properties:\n                    fromPath:\n                      description: The path to copy contents from, defaults to the\n                        root directory.\n                      type: string\n                    repository:\n                      description: Reference to a GitRepository to include.\n                      properties:\n                        name:\n                          description: Name of the referent.\n                          type: string\n                      required:\n                      - name\n                      type: object\n                    toPath:\n                      description: The path to copy contents to, defaults to the name\n                        of the source ref.\n                      type: string\n                  required:\n                  - repository\n                  type: object\n                type: array\n              interval:\n                description: The interval at which to check for repository updates.\n                type: string\n              recurseSubmodules:\n                description: When enabled, after the clone is created, initializes\n                  all submodules within, using their default settings. This option\n                  is available only when using the 'go-git' GitImplementation.\n                type: boolean\n              ref:\n                description: The Git reference to checkout and monitor for changes,\n                  defaults to master branch.\n                properties:\n                  branch:\n                    description: The Git branch to checkout, defaults to master.\n                    type: string\n                  commit:\n                    description: The Git commit SHA to checkout, if specified Tag\n                      filters will be ignored.\n                    type: string\n                  semver:\n                    description: The Git tag semver expression, takes precedence over\n                      Tag.\n                    type: string\n                  tag:\n                    description: The Git tag to checkout, takes precedence over Branch.\n                    type: string\n                type: object\n              secretRef:\n                description: The secret name containing the Git credentials. For HTTPS\n                  repositories the secret must contain username and password fields.\n                  For SSH repositories the secret must contain identity and known_hosts\n                  fields.\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              suspend:\n                description: This flag tells the controller to suspend the reconciliation\n                  of this source.\n                type: boolean\n              timeout:\n                default: 60s\n                description: The timeout for remote Git operations like cloning, defaults\n                  to 60s.\n                type: string\n              url:\n                description: The repository URL, can be a HTTP/S or SSH address.\n                pattern: ^(http|https|ssh)://\n                type: string\n              verify:\n                description: Verify OpenPGP signature for the Git commit HEAD points\n                  to.\n                properties:\n                  mode:\n                    description: Mode describes what git object should be verified,\n                      currently ('head').\n                    enum:\n                    - head\n                    type: string\n                  secretRef:\n                    description: The secret name containing the public keys of all\n                      trusted Git authors.\n                    properties:\n                      name:\n                        description: Name of the referent.\n                        type: string\n                    required:\n                    - name\n                    type: object\n                required:\n                - mode\n                type: object\n            required:\n            - interval\n            - url\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: GitRepositoryStatus defines the observed state of a Git repository.\n            properties:\n              artifact:\n                description: Artifact represents the output of the last successful\n                  repository sync.\n                properties:\n                  checksum:\n                    description: Checksum is the SHA256 checksum of the artifact.\n                    type: string\n                  lastUpdateTime:\n                    description: LastUpdateTime is the timestamp corresponding to\n                      the last update of this artifact.\n                    format: date-time\n                    type: string\n                  path:\n                    description: Path is the relative file path of this artifact.\n                    type: string\n                  revision:\n                    description: Revision is a human readable identifier traceable\n                      in the origin source system. It can be a Git commit SHA, Git\n                      tag, a Helm index timestamp, a Helm chart version, etc.\n                    type: string\n                  url:\n                    description: URL is the HTTP address of this artifact.\n                    type: string\n                required:\n                - path\n                - url\n                type: object\n              conditions:\n                description: Conditions holds the conditions for the GitRepository.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              includedArtifacts:\n                description: IncludedArtifacts represents the included artifacts from\n                  the last successful repository sync.\n                items:\n                  description: Artifact represents the output of a source synchronisation.\n                  properties:\n                    checksum:\n                      description: Checksum is the SHA256 checksum of the artifact.\n                      type: string\n                    lastUpdateTime:\n                      description: LastUpdateTime is the timestamp corresponding to\n                        the last update of this artifact.\n                      format: date-time\n                      type: string\n                    path:\n                      description: Path is the relative file path of this artifact.\n                      type: string\n                    revision:\n                      description: Revision is a human readable identifier traceable\n                        in the origin source system. It can be a Git commit SHA, Git\n                        tag, a Helm index timestamp, a Helm chart version, etc.\n                      type: string\n                    url:\n                      description: URL is the HTTP address of this artifact.\n                      type: string\n                  required:\n                  - path\n                  - url\n                  type: object\n                type: array\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation.\n                format: int64\n                type: integer\n              url:\n                description: URL is the download link for the artifact output of the\n                  last repository sync.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: false\n    subresources:\n      status: {}\n  - additionalPrinterColumns:\n    - jsonPath: .spec.url\n      name: URL\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v1beta2\n    schema:\n      openAPIV3Schema:\n        description: GitRepository is the Schema for the gitrepositories API.\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: GitRepositorySpec specifies the required configuration to\n              produce an Artifact for a Git repository.\n            properties:\n              accessFrom:\n                description: 'AccessFrom specifies an Access Control List for allowing\n                  cross-namespace references to this object. NOTE: Not implemented,\n                  provisional as of https://github.com/fluxcd/flux2/pull/2092'\n                properties:\n                  namespaceSelectors:\n                    description: NamespaceSelectors is the list of namespace selectors\n                      to which this ACL applies. Items in this list are evaluated\n                      using a logical OR operation.\n                    items:\n                      description: NamespaceSelector selects the namespaces to which\n                        this ACL applies. An empty map of MatchLabels matches all\n                        namespaces in a cluster.\n                      properties:\n                        matchLabels:\n                          additionalProperties:\n                            type: string\n                          description: MatchLabels is a map of {key,value} pairs.\n                            A single {key,value} in the matchLabels map is equivalent\n                            to an element of matchExpressions, whose key field is\n                            \"key\", the operator is \"In\", and the values array contains\n                            only \"value\". The requirements are ANDed.\n                          type: object\n                      type: object\n                    type: array\n                required:\n                - namespaceSelectors\n                type: object\n              gitImplementation:\n                default: go-git\n                description: GitImplementation specifies which Git client library\n                  implementation to use. Defaults to 'go-git', valid values are ('go-git',\n                  'libgit2').\n                enum:\n                - go-git\n                - libgit2\n                type: string\n              ignore:\n                description: Ignore overrides the set of excluded patterns in the\n                  .sourceignore format (which is the same as .gitignore). If not provided,\n                  a default will be used, consult the documentation for your version\n                  to find out what those are.\n                type: string\n              include:\n                description: Include specifies a list of GitRepository resources which\n                  Artifacts should be included in the Artifact produced for this GitRepository.\n                items:\n                  description: GitRepositoryInclude specifies a local reference to\n                    a GitRepository which Artifact (sub-)contents must be included,\n                    and where they should be placed.\n                  properties:\n                    fromPath:\n                      description: FromPath specifies the path to copy contents from,\n                        defaults to the root of the Artifact.\n                      type: string\n                    repository:\n                      description: GitRepositoryRef specifies the GitRepository which\n                        Artifact contents must be included.\n                      properties:\n                        name:\n                          description: Name of the referent.\n                          type: string\n                      required:\n                      - name\n                      type: object\n                    toPath:\n                      description: ToPath specifies the path to copy contents to,\n                        defaults to the name of the GitRepositoryRef.\n                      type: string\n                  required:\n                  - repository\n                  type: object\n                type: array\n              interval:\n                description: Interval at which to check the GitRepository for updates.\n                type: string\n              recurseSubmodules:\n                description: RecurseSubmodules enables the initialization of all submodules\n                  within the GitRepository as cloned from the URL, using their default\n                  settings. This option is available only when using the 'go-git'\n                  GitImplementation.\n                type: boolean\n              ref:\n                description: Reference specifies the Git reference to resolve and\n                  monitor for changes, defaults to the 'master' branch.\n                properties:\n                  branch:\n                    description: \"Branch to check out, defaults to 'master' if no\n                      other field is defined. \\n When GitRepositorySpec.GitImplementation\n                      is set to 'go-git', a shallow clone of the specified branch\n                      is performed.\"\n                    type: string\n                  commit:\n                    description: \"Commit SHA to check out, takes precedence over all\n                      reference fields. \\n When GitRepositorySpec.GitImplementation\n                      is set to 'go-git', this can be combined with Branch to shallow\n                      clone the branch, in which the commit is expected to exist.\"\n                    type: string\n                  semver:\n                    description: SemVer tag expression to check out, takes precedence\n                      over Tag.\n                    type: string\n                  tag:\n                    description: Tag to check out, takes precedence over Branch.\n                    type: string\n                type: object\n              secretRef:\n                description: SecretRef specifies the Secret containing authentication\n                  credentials for the GitRepository. For HTTPS repositories the Secret\n                  must contain 'username' and 'password' fields. For SSH repositories\n                  the Secret must contain 'identity' and 'known_hosts' fields.\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              suspend:\n                description: Suspend tells the controller to suspend the reconciliation\n                  of this GitRepository.\n                type: boolean\n              timeout:\n                default: 60s\n                description: Timeout for Git operations like cloning, defaults to\n                  60s.\n                type: string\n              url:\n                description: URL specifies the Git repository URL, it can be an HTTP/S\n                  or SSH address.\n                pattern: ^(http|https|ssh)://\n                type: string\n              verify:\n                description: Verification specifies the configuration to verify the\n                  Git commit signature(s).\n                properties:\n                  mode:\n                    description: Mode specifies what Git object should be verified,\n                      currently ('head').\n                    enum:\n                    - head\n                    type: string\n                  secretRef:\n                    description: SecretRef specifies the Secret containing the public\n                      keys of trusted Git authors.\n                    properties:\n                      name:\n                        description: Name of the referent.\n                        type: string\n                    required:\n                    - name\n                    type: object\n                required:\n                - mode\n                type: object\n            required:\n            - interval\n            - url\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: GitRepositoryStatus records the observed state of a Git repository.\n            properties:\n              artifact:\n                description: Artifact represents the last successful GitRepository\n                  reconciliation.\n                properties:\n                  checksum:\n                    description: Checksum is the SHA256 checksum of the Artifact file.\n                    type: string\n                  lastUpdateTime:\n                    description: LastUpdateTime is the timestamp corresponding to\n                      the last update of the Artifact.\n                    format: date-time\n                    type: string\n                  path:\n                    description: Path is the relative file path of the Artifact. It\n                      can be used to locate the file in the root of the Artifact storage\n                      on the local file system of the controller managing the Source.\n                    type: string\n                  revision:\n                    description: Revision is a human-readable identifier traceable\n                      in the origin source system. It can be a Git commit SHA, Git\n                      tag, a Helm chart version, etc.\n                    type: string\n                  size:\n                    description: Size is the number of bytes in the file.\n                    format: int64\n                    type: integer\n                  url:\n                    description: URL is the HTTP address of the Artifact as exposed\n                      by the controller managing the Source. It can be used to retrieve\n                      the Artifact for consumption, e.g. by another controller applying\n                      the Artifact contents.\n                    type: string\n                required:\n                - path\n                - url\n                type: object\n              conditions:\n                description: Conditions holds the conditions for the GitRepository.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              includedArtifacts:\n                description: IncludedArtifacts contains a list of the last successfully\n                  included Artifacts as instructed by GitRepositorySpec.Include.\n                items:\n                  description: Artifact represents the output of a Source reconciliation.\n                  properties:\n                    checksum:\n                      description: Checksum is the SHA256 checksum of the Artifact\n                        file.\n                      type: string\n                    lastUpdateTime:\n                      description: LastUpdateTime is the timestamp corresponding to\n                        the last update of the Artifact.\n                      format: date-time\n                      type: string\n                    path:\n                      description: Path is the relative file path of the Artifact.\n                        It can be used to locate the file in the root of the Artifact\n                        storage on the local file system of the controller managing\n                        the Source.\n                      type: string\n                    revision:\n                      description: Revision is a human-readable identifier traceable\n                        in the origin source system. It can be a Git commit SHA, Git\n                        tag, a Helm chart version, etc.\n                      type: string\n                    size:\n                      description: Size is the number of bytes in the file.\n                      format: int64\n                      type: integer\n                    url:\n                      description: URL is the HTTP address of the Artifact as exposed\n                        by the controller managing the Source. It can be used to retrieve\n                        the Artifact for consumption, e.g. by another controller applying\n                        the Artifact contents.\n                      type: string\n                  required:\n                  - path\n                  - url\n                  type: object\n                type: array\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation of\n                  the GitRepository object.\n                format: int64\n                type: integer\n              url:\n                description: URL is the dynamic fetch link for the latest Artifact.\n                  It is provided on a \"best effort\" basis, and using the precise GitRepositoryStatus.Artifact\n                  data is recommended.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []",
+            "yaml_body_parsed": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: gitrepositories.source.toolkit.fluxcd.io\nspec:\n  group: source.toolkit.fluxcd.io\n  names:\n    kind: GitRepository\n    listKind: GitRepositoryList\n    plural: gitrepositories\n    shortNames:\n    - gitrepo\n    singular: gitrepository\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .spec.url\n      name: URL\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    name: v1beta1\n    schema:\n      openAPIV3Schema:\n        description: GitRepository is the Schema for the gitrepositories API\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: GitRepositorySpec defines the desired state of a Git repository.\n            properties:\n              accessFrom:\n                description: AccessFrom defines an Access Control List for allowing\n                  cross-namespace references to this object.\n                properties:\n                  namespaceSelectors:\n                    description: NamespaceSelectors is the list of namespace selectors\n                      to which this ACL applies. Items in this list are evaluated\n                      using a logical OR operation.\n                    items:\n                      description: NamespaceSelector selects the namespaces to which\n                        this ACL applies. An empty map of MatchLabels matches all\n                        namespaces in a cluster.\n                      properties:\n                        matchLabels:\n                          additionalProperties:\n                            type: string\n                          description: MatchLabels is a map of {key,value} pairs.\n                            A single {key,value} in the matchLabels map is equivalent\n                            to an element of matchExpressions, whose key field is\n                            \"key\", the operator is \"In\", and the values array contains\n                            only \"value\". The requirements are ANDed.\n                          type: object\n                      type: object\n                    type: array\n                required:\n                - namespaceSelectors\n                type: object\n              gitImplementation:\n                default: go-git\n                description: Determines which git client library to use. Defaults\n                  to go-git, valid values are ('go-git', 'libgit2').\n                enum:\n                - go-git\n                - libgit2\n                type: string\n              ignore:\n                description: Ignore overrides the set of excluded patterns in the\n                  .sourceignore format (which is the same as .gitignore). If not provided,\n                  a default will be used, consult the documentation for your version\n                  to find out what those are.\n                type: string\n              include:\n                description: Extra git repositories to map into the repository\n                items:\n                  description: GitRepositoryInclude defines a source with a from and\n                    to path.\n                  properties:\n                    fromPath:\n                      description: The path to copy contents from, defaults to the\n                        root directory.\n                      type: string\n                    repository:\n                      description: Reference to a GitRepository to include.\n                      properties:\n                        name:\n                          description: Name of the referent.\n                          type: string\n                      required:\n                      - name\n                      type: object\n                    toPath:\n                      description: The path to copy contents to, defaults to the name\n                        of the source ref.\n                      type: string\n                  required:\n                  - repository\n                  type: object\n                type: array\n              interval:\n                description: The interval at which to check for repository updates.\n                type: string\n              recurseSubmodules:\n                description: When enabled, after the clone is created, initializes\n                  all submodules within, using their default settings. This option\n                  is available only when using the 'go-git' GitImplementation.\n                type: boolean\n              ref:\n                description: The Git reference to checkout and monitor for changes,\n                  defaults to master branch.\n                properties:\n                  branch:\n                    description: The Git branch to checkout, defaults to master.\n                    type: string\n                  commit:\n                    description: The Git commit SHA to checkout, if specified Tag\n                      filters will be ignored.\n                    type: string\n                  semver:\n                    description: The Git tag semver expression, takes precedence over\n                      Tag.\n                    type: string\n                  tag:\n                    description: The Git tag to checkout, takes precedence over Branch.\n                    type: string\n                type: object\n              secretRef:\n                description: The secret name containing the Git credentials. For HTTPS\n                  repositories the secret must contain username and password fields.\n                  For SSH repositories the secret must contain identity and known_hosts\n                  fields.\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              suspend:\n                description: This flag tells the controller to suspend the reconciliation\n                  of this source.\n                type: boolean\n              timeout:\n                default: 60s\n                description: The timeout for remote Git operations like cloning, defaults\n                  to 60s.\n                type: string\n              url:\n                description: The repository URL, can be a HTTP/S or SSH address.\n                pattern: ^(http|https|ssh)://\n                type: string\n              verify:\n                description: Verify OpenPGP signature for the Git commit HEAD points\n                  to.\n                properties:\n                  mode:\n                    description: Mode describes what git object should be verified,\n                      currently ('head').\n                    enum:\n                    - head\n                    type: string\n                  secretRef:\n                    description: The secret name containing the public keys of all\n                      trusted Git authors.\n                    properties:\n                      name:\n                        description: Name of the referent.\n                        type: string\n                    required:\n                    - name\n                    type: object\n                required:\n                - mode\n                type: object\n            required:\n            - interval\n            - url\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: GitRepositoryStatus defines the observed state of a Git repository.\n            properties:\n              artifact:\n                description: Artifact represents the output of the last successful\n                  repository sync.\n                properties:\n                  checksum:\n                    description: Checksum is the SHA256 checksum of the artifact.\n                    type: string\n                  lastUpdateTime:\n                    description: LastUpdateTime is the timestamp corresponding to\n                      the last update of this artifact.\n                    format: date-time\n                    type: string\n                  path:\n                    description: Path is the relative file path of this artifact.\n                    type: string\n                  revision:\n                    description: Revision is a human readable identifier traceable\n                      in the origin source system. It can be a Git commit SHA, Git\n                      tag, a Helm index timestamp, a Helm chart version, etc.\n                    type: string\n                  url:\n                    description: URL is the HTTP address of this artifact.\n                    type: string\n                required:\n                - path\n                - url\n                type: object\n              conditions:\n                description: Conditions holds the conditions for the GitRepository.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              includedArtifacts:\n                description: IncludedArtifacts represents the included artifacts from\n                  the last successful repository sync.\n                items:\n                  description: Artifact represents the output of a source synchronisation.\n                  properties:\n                    checksum:\n                      description: Checksum is the SHA256 checksum of the artifact.\n                      type: string\n                    lastUpdateTime:\n                      description: LastUpdateTime is the timestamp corresponding to\n                        the last update of this artifact.\n                      format: date-time\n                      type: string\n                    path:\n                      description: Path is the relative file path of this artifact.\n                      type: string\n                    revision:\n                      description: Revision is a human readable identifier traceable\n                        in the origin source system. It can be a Git commit SHA, Git\n                        tag, a Helm index timestamp, a Helm chart version, etc.\n                      type: string\n                    url:\n                      description: URL is the HTTP address of this artifact.\n                      type: string\n                  required:\n                  - path\n                  - url\n                  type: object\n                type: array\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation.\n                format: int64\n                type: integer\n              url:\n                description: URL is the download link for the artifact output of the\n                  last repository sync.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: false\n    subresources:\n      status: {}\n  - additionalPrinterColumns:\n    - jsonPath: .spec.url\n      name: URL\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v1beta2\n    schema:\n      openAPIV3Schema:\n        description: GitRepository is the Schema for the gitrepositories API.\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: GitRepositorySpec specifies the required configuration to\n              produce an Artifact for a Git repository.\n            properties:\n              accessFrom:\n                description: 'AccessFrom specifies an Access Control List for allowing\n                  cross-namespace references to this object. NOTE: Not implemented,\n                  provisional as of https://github.com/fluxcd/flux2/pull/2092'\n                properties:\n                  namespaceSelectors:\n                    description: NamespaceSelectors is the list of namespace selectors\n                      to which this ACL applies. Items in this list are evaluated\n                      using a logical OR operation.\n                    items:\n                      description: NamespaceSelector selects the namespaces to which\n                        this ACL applies. An empty map of MatchLabels matches all\n                        namespaces in a cluster.\n                      properties:\n                        matchLabels:\n                          additionalProperties:\n                            type: string\n                          description: MatchLabels is a map of {key,value} pairs.\n                            A single {key,value} in the matchLabels map is equivalent\n                            to an element of matchExpressions, whose key field is\n                            \"key\", the operator is \"In\", and the values array contains\n                            only \"value\". The requirements are ANDed.\n                          type: object\n                      type: object\n                    type: array\n                required:\n                - namespaceSelectors\n                type: object\n              gitImplementation:\n                default: go-git\n                description: GitImplementation specifies which Git client library\n                  implementation to use. Defaults to 'go-git', valid values are ('go-git',\n                  'libgit2').\n                enum:\n                - go-git\n                - libgit2\n                type: string\n              ignore:\n                description: Ignore overrides the set of excluded patterns in the\n                  .sourceignore format (which is the same as .gitignore). If not provided,\n                  a default will be used, consult the documentation for your version\n                  to find out what those are.\n                type: string\n              include:\n                description: Include specifies a list of GitRepository resources which\n                  Artifacts should be included in the Artifact produced for this GitRepository.\n                items:\n                  description: GitRepositoryInclude specifies a local reference to\n                    a GitRepository which Artifact (sub-)contents must be included,\n                    and where they should be placed.\n                  properties:\n                    fromPath:\n                      description: FromPath specifies the path to copy contents from,\n                        defaults to the root of the Artifact.\n                      type: string\n                    repository:\n                      description: GitRepositoryRef specifies the GitRepository which\n                        Artifact contents must be included.\n                      properties:\n                        name:\n                          description: Name of the referent.\n                          type: string\n                      required:\n                      - name\n                      type: object\n                    toPath:\n                      description: ToPath specifies the path to copy contents to,\n                        defaults to the name of the GitRepositoryRef.\n                      type: string\n                  required:\n                  - repository\n                  type: object\n                type: array\n              interval:\n                description: Interval at which to check the GitRepository for updates.\n                type: string\n              recurseSubmodules:\n                description: RecurseSubmodules enables the initialization of all submodules\n                  within the GitRepository as cloned from the URL, using their default\n                  settings. This option is available only when using the 'go-git'\n                  GitImplementation.\n                type: boolean\n              ref:\n                description: Reference specifies the Git reference to resolve and\n                  monitor for changes, defaults to the 'master' branch.\n                properties:\n                  branch:\n                    description: \"Branch to check out, defaults to 'master' if no\n                      other field is defined. \\n When GitRepositorySpec.GitImplementation\n                      is set to 'go-git', a shallow clone of the specified branch\n                      is performed.\"\n                    type: string\n                  commit:\n                    description: \"Commit SHA to check out, takes precedence over all\n                      reference fields. \\n When GitRepositorySpec.GitImplementation\n                      is set to 'go-git', this can be combined with Branch to shallow\n                      clone the branch, in which the commit is expected to exist.\"\n                    type: string\n                  semver:\n                    description: SemVer tag expression to check out, takes precedence\n                      over Tag.\n                    type: string\n                  tag:\n                    description: Tag to check out, takes precedence over Branch.\n                    type: string\n                type: object\n              secretRef:\n                description: SecretRef specifies the Secret containing authentication\n                  credentials for the GitRepository. For HTTPS repositories the Secret\n                  must contain 'username' and 'password' fields. For SSH repositories\n                  the Secret must contain 'identity' and 'known_hosts' fields.\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              suspend:\n                description: Suspend tells the controller to suspend the reconciliation\n                  of this GitRepository.\n                type: boolean\n              timeout:\n                default: 60s\n                description: Timeout for Git operations like cloning, defaults to\n                  60s.\n                type: string\n              url:\n                description: URL specifies the Git repository URL, it can be an HTTP/S\n                  or SSH address.\n                pattern: ^(http|https|ssh)://\n                type: string\n              verify:\n                description: Verification specifies the configuration to verify the\n                  Git commit signature(s).\n                properties:\n                  mode:\n                    description: Mode specifies what Git object should be verified,\n                      currently ('head').\n                    enum:\n                    - head\n                    type: string\n                  secretRef:\n                    description: SecretRef specifies the Secret containing the public\n                      keys of trusted Git authors.\n                    properties:\n                      name:\n                        description: Name of the referent.\n                        type: string\n                    required:\n                    - name\n                    type: object\n                required:\n                - mode\n                type: object\n            required:\n            - interval\n            - url\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: GitRepositoryStatus records the observed state of a Git repository.\n            properties:\n              artifact:\n                description: Artifact represents the last successful GitRepository\n                  reconciliation.\n                properties:\n                  checksum:\n                    description: Checksum is the SHA256 checksum of the Artifact file.\n                    type: string\n                  lastUpdateTime:\n                    description: LastUpdateTime is the timestamp corresponding to\n                      the last update of the Artifact.\n                    format: date-time\n                    type: string\n                  path:\n                    description: Path is the relative file path of the Artifact. It\n                      can be used to locate the file in the root of the Artifact storage\n                      on the local file system of the controller managing the Source.\n                    type: string\n                  revision:\n                    description: Revision is a human-readable identifier traceable\n                      in the origin source system. It can be a Git commit SHA, Git\n                      tag, a Helm chart version, etc.\n                    type: string\n                  size:\n                    description: Size is the number of bytes in the file.\n                    format: int64\n                    type: integer\n                  url:\n                    description: URL is the HTTP address of the Artifact as exposed\n                      by the controller managing the Source. It can be used to retrieve\n                      the Artifact for consumption, e.g. by another controller applying\n                      the Artifact contents.\n                    type: string\n                required:\n                - path\n                - url\n                type: object\n              conditions:\n                description: Conditions holds the conditions for the GitRepository.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              includedArtifacts:\n                description: IncludedArtifacts contains a list of the last successfully\n                  included Artifacts as instructed by GitRepositorySpec.Include.\n                items:\n                  description: Artifact represents the output of a Source reconciliation.\n                  properties:\n                    checksum:\n                      description: Checksum is the SHA256 checksum of the Artifact\n                        file.\n                      type: string\n                    lastUpdateTime:\n                      description: LastUpdateTime is the timestamp corresponding to\n                        the last update of the Artifact.\n                      format: date-time\n                      type: string\n                    path:\n                      description: Path is the relative file path of the Artifact.\n                        It can be used to locate the file in the root of the Artifact\n                        storage on the local file system of the controller managing\n                        the Source.\n                      type: string\n                    revision:\n                      description: Revision is a human-readable identifier traceable\n                        in the origin source system. It can be a Git commit SHA, Git\n                        tag, a Helm chart version, etc.\n                      type: string\n                    size:\n                      description: Size is the number of bytes in the file.\n                      format: int64\n                      type: integer\n                    url:\n                      description: URL is the HTTP address of the Artifact as exposed\n                        by the controller managing the Source. It can be used to retrieve\n                        the Artifact for consumption, e.g. by another controller applying\n                        the Artifact contents.\n                      type: string\n                  required:\n                  - path\n                  - url\n                  type: object\n                type: array\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation of\n                  the GitRepository object.\n                format: int64\n                type: integer\n              url:\n                description: URL is the dynamic fetch link for the latest Artifact.\n                  It is provided on a \"best effort\" basis, and using the precise GitRepositoryStatus.Artifact\n                  data is recommended.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []\n",
+            "yaml_incluster": "ebe9ab24635dab17661e2f41e74bf6f100c9b31f4181530b8146580b6d506d57"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "apiextensions.k8s.io/v1/customresourcedefinition/helmcharts.source.toolkit.fluxcd.io",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "apiextensions.k8s.io/v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions/helmcharts.source.toolkit.fluxcd.io",
+            "ignore_fields": null,
+            "kind": "CustomResourceDefinition",
+            "live_manifest_incluster": "aad2c1c316d96f34f649fef444b0d0ecbc73ea02b5824b33285968dc05b6b41c",
+            "live_uid": "d6e363e7-ce9e-46ee-bb10-d61e06d50013",
+            "name": "helmcharts.source.toolkit.fluxcd.io",
+            "namespace": null,
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "d6e363e7-ce9e-46ee-bb10-d61e06d50013",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: helmcharts.source.toolkit.fluxcd.io\nspec:\n  group: source.toolkit.fluxcd.io\n  names:\n    kind: HelmChart\n    listKind: HelmChartList\n    plural: helmcharts\n    shortNames:\n    - hc\n    singular: helmchart\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .spec.chart\n      name: Chart\n      type: string\n    - jsonPath: .spec.version\n      name: Version\n      type: string\n    - jsonPath: .spec.sourceRef.kind\n      name: Source Kind\n      type: string\n    - jsonPath: .spec.sourceRef.name\n      name: Source Name\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    name: v1beta1\n    schema:\n      openAPIV3Schema:\n        description: HelmChart is the Schema for the helmcharts API\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: HelmChartSpec defines the desired state of a Helm chart.\n            properties:\n              accessFrom:\n                description: AccessFrom defines an Access Control List for allowing\n                  cross-namespace references to this object.\n                properties:\n                  namespaceSelectors:\n                    description: NamespaceSelectors is the list of namespace selectors\n                      to which this ACL applies. Items in this list are evaluated\n                      using a logical OR operation.\n                    items:\n                      description: NamespaceSelector selects the namespaces to which\n                        this ACL applies. An empty map of MatchLabels matches all\n                        namespaces in a cluster.\n                      properties:\n                        matchLabels:\n                          additionalProperties:\n                            type: string\n                          description: MatchLabels is a map of {key,value} pairs.\n                            A single {key,value} in the matchLabels map is equivalent\n                            to an element of matchExpressions, whose key field is\n                            \"key\", the operator is \"In\", and the values array contains\n                            only \"value\". The requirements are ANDed.\n                          type: object\n                      type: object\n                    type: array\n                required:\n                - namespaceSelectors\n                type: object\n              chart:\n                description: The name or path the Helm chart is available at in the\n                  SourceRef.\n                type: string\n              interval:\n                description: The interval at which to check the Source for updates.\n                type: string\n              reconcileStrategy:\n                default: ChartVersion\n                description: Determines what enables the creation of a new artifact.\n                  Valid values are ('ChartVersion', 'Revision'). See the documentation\n                  of the values for an explanation on their behavior. Defaults to\n                  ChartVersion when omitted.\n                enum:\n                - ChartVersion\n                - Revision\n                type: string\n              sourceRef:\n                description: The reference to the Source the chart is available at.\n                properties:\n                  apiVersion:\n                    description: APIVersion of the referent.\n                    type: string\n                  kind:\n                    description: Kind of the referent, valid values are ('HelmRepository',\n                      'GitRepository', 'Bucket').\n                    enum:\n                    - HelmRepository\n                    - GitRepository\n                    - Bucket\n                    type: string\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - kind\n                - name\n                type: object\n              suspend:\n                description: This flag tells the controller to suspend the reconciliation\n                  of this source.\n                type: boolean\n              valuesFile:\n                description: Alternative values file to use as the default chart values,\n                  expected to be a relative path in the SourceRef. Deprecated in favor\n                  of ValuesFiles, for backwards compatibility the file defined here\n                  is merged before the ValuesFiles items. Ignored when omitted.\n                type: string\n              valuesFiles:\n                description: Alternative list of values files to use as the chart\n                  values (values.yaml is not included by default), expected to be\n                  a relative path in the SourceRef. Values files are merged in the\n                  order of this list with the last file overriding the first. Ignored\n                  when omitted.\n                items:\n                  type: string\n                type: array\n              version:\n                default: '*'\n                description: The chart version semver expression, ignored for charts\n                  from GitRepository and Bucket sources. Defaults to latest when omitted.\n                type: string\n            required:\n            - chart\n            - interval\n            - sourceRef\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: HelmChartStatus defines the observed state of the HelmChart.\n            properties:\n              artifact:\n                description: Artifact represents the output of the last successful\n                  chart sync.\n                properties:\n                  checksum:\n                    description: Checksum is the SHA256 checksum of the artifact.\n                    type: string\n                  lastUpdateTime:\n                    description: LastUpdateTime is the timestamp corresponding to\n                      the last update of this artifact.\n                    format: date-time\n                    type: string\n                  path:\n                    description: Path is the relative file path of this artifact.\n                    type: string\n                  revision:\n                    description: Revision is a human readable identifier traceable\n                      in the origin source system. It can be a Git commit SHA, Git\n                      tag, a Helm index timestamp, a Helm chart version, etc.\n                    type: string\n                  url:\n                    description: URL is the HTTP address of this artifact.\n                    type: string\n                required:\n                - path\n                - url\n                type: object\n              conditions:\n                description: Conditions holds the conditions for the HelmChart.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation.\n                format: int64\n                type: integer\n              url:\n                description: URL is the download link for the last chart pulled.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: false\n    subresources:\n      status: {}\n  - additionalPrinterColumns:\n    - jsonPath: .spec.chart\n      name: Chart\n      type: string\n    - jsonPath: .spec.version\n      name: Version\n      type: string\n    - jsonPath: .spec.sourceRef.kind\n      name: Source Kind\n      type: string\n    - jsonPath: .spec.sourceRef.name\n      name: Source Name\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v1beta2\n    schema:\n      openAPIV3Schema:\n        description: HelmChart is the Schema for the helmcharts API.\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: HelmChartSpec specifies the desired state of a Helm chart.\n            properties:\n              accessFrom:\n                description: 'AccessFrom specifies an Access Control List for allowing\n                  cross-namespace references to this object. NOTE: Not implemented,\n                  provisional as of https://github.com/fluxcd/flux2/pull/2092'\n                properties:\n                  namespaceSelectors:\n                    description: NamespaceSelectors is the list of namespace selectors\n                      to which this ACL applies. Items in this list are evaluated\n                      using a logical OR operation.\n                    items:\n                      description: NamespaceSelector selects the namespaces to which\n                        this ACL applies. An empty map of MatchLabels matches all\n                        namespaces in a cluster.\n                      properties:\n                        matchLabels:\n                          additionalProperties:\n                            type: string\n                          description: MatchLabels is a map of {key,value} pairs.\n                            A single {key,value} in the matchLabels map is equivalent\n                            to an element of matchExpressions, whose key field is\n                            \"key\", the operator is \"In\", and the values array contains\n                            only \"value\". The requirements are ANDed.\n                          type: object\n                      type: object\n                    type: array\n                required:\n                - namespaceSelectors\n                type: object\n              chart:\n                description: Chart is the name or path the Helm chart is available\n                  at in the SourceRef.\n                type: string\n              interval:\n                description: Interval is the interval at which to check the Source\n                  for updates.\n                type: string\n              reconcileStrategy:\n                default: ChartVersion\n                description: ReconcileStrategy determines what enables the creation\n                  of a new artifact. Valid values are ('ChartVersion', 'Revision').\n                  See the documentation of the values for an explanation on their\n                  behavior. Defaults to ChartVersion when omitted.\n                enum:\n                - ChartVersion\n                - Revision\n                type: string\n              sourceRef:\n                description: SourceRef is the reference to the Source the chart is\n                  available at.\n                properties:\n                  apiVersion:\n                    description: APIVersion of the referent.\n                    type: string\n                  kind:\n                    description: Kind of the referent, valid values are ('HelmRepository',\n                      'GitRepository', 'Bucket').\n                    enum:\n                    - HelmRepository\n                    - GitRepository\n                    - Bucket\n                    type: string\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - kind\n                - name\n                type: object\n              suspend:\n                description: Suspend tells the controller to suspend the reconciliation\n                  of this source.\n                type: boolean\n              valuesFile:\n                description: ValuesFile is an alternative values file to use as the\n                  default chart values, expected to be a relative path in the SourceRef.\n                  Deprecated in favor of ValuesFiles, for backwards compatibility\n                  the file specified here is merged before the ValuesFiles items.\n                  Ignored when omitted.\n                type: string\n              valuesFiles:\n                description: ValuesFiles is an alternative list of values files to\n                  use as the chart values (values.yaml is not included by default),\n                  expected to be a relative path in the SourceRef. Values files are\n                  merged in the order of this list with the last file overriding the\n                  first. Ignored when omitted.\n                items:\n                  type: string\n                type: array\n              version:\n                default: '*'\n                description: Version is the chart version semver expression, ignored\n                  for charts from GitRepository and Bucket sources. Defaults to latest\n                  when omitted.\n                type: string\n            required:\n            - chart\n            - interval\n            - sourceRef\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: HelmChartStatus records the observed state of the HelmChart.\n            properties:\n              artifact:\n                description: Artifact represents the output of the last successful\n                  reconciliation.\n                properties:\n                  checksum:\n                    description: Checksum is the SHA256 checksum of the Artifact file.\n                    type: string\n                  lastUpdateTime:\n                    description: LastUpdateTime is the timestamp corresponding to\n                      the last update of the Artifact.\n                    format: date-time\n                    type: string\n                  path:\n                    description: Path is the relative file path of the Artifact. It\n                      can be used to locate the file in the root of the Artifact storage\n                      on the local file system of the controller managing the Source.\n                    type: string\n                  revision:\n                    description: Revision is a human-readable identifier traceable\n                      in the origin source system. It can be a Git commit SHA, Git\n                      tag, a Helm chart version, etc.\n                    type: string\n                  size:\n                    description: Size is the number of bytes in the file.\n                    format: int64\n                    type: integer\n                  url:\n                    description: URL is the HTTP address of the Artifact as exposed\n                      by the controller managing the Source. It can be used to retrieve\n                      the Artifact for consumption, e.g. by another controller applying\n                      the Artifact contents.\n                    type: string\n                required:\n                - path\n                - url\n                type: object\n              conditions:\n                description: Conditions holds the conditions for the HelmChart.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedChartName:\n                description: ObservedChartName is the last observed chart name as\n                  specified by the resolved chart reference.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation of\n                  the HelmChart object.\n                format: int64\n                type: integer\n              observedSourceArtifactRevision:\n                description: ObservedSourceArtifactRevision is the last observed Artifact.Revision\n                  of the HelmChartSpec.SourceRef.\n                type: string\n              url:\n                description: URL is the dynamic fetch link for the latest Artifact.\n                  It is provided on a \"best effort\" basis, and using the precise BucketStatus.Artifact\n                  data is recommended.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []",
+            "yaml_body_parsed": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: helmcharts.source.toolkit.fluxcd.io\nspec:\n  group: source.toolkit.fluxcd.io\n  names:\n    kind: HelmChart\n    listKind: HelmChartList\n    plural: helmcharts\n    shortNames:\n    - hc\n    singular: helmchart\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .spec.chart\n      name: Chart\n      type: string\n    - jsonPath: .spec.version\n      name: Version\n      type: string\n    - jsonPath: .spec.sourceRef.kind\n      name: Source Kind\n      type: string\n    - jsonPath: .spec.sourceRef.name\n      name: Source Name\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    name: v1beta1\n    schema:\n      openAPIV3Schema:\n        description: HelmChart is the Schema for the helmcharts API\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: HelmChartSpec defines the desired state of a Helm chart.\n            properties:\n              accessFrom:\n                description: AccessFrom defines an Access Control List for allowing\n                  cross-namespace references to this object.\n                properties:\n                  namespaceSelectors:\n                    description: NamespaceSelectors is the list of namespace selectors\n                      to which this ACL applies. Items in this list are evaluated\n                      using a logical OR operation.\n                    items:\n                      description: NamespaceSelector selects the namespaces to which\n                        this ACL applies. An empty map of MatchLabels matches all\n                        namespaces in a cluster.\n                      properties:\n                        matchLabels:\n                          additionalProperties:\n                            type: string\n                          description: MatchLabels is a map of {key,value} pairs.\n                            A single {key,value} in the matchLabels map is equivalent\n                            to an element of matchExpressions, whose key field is\n                            \"key\", the operator is \"In\", and the values array contains\n                            only \"value\". The requirements are ANDed.\n                          type: object\n                      type: object\n                    type: array\n                required:\n                - namespaceSelectors\n                type: object\n              chart:\n                description: The name or path the Helm chart is available at in the\n                  SourceRef.\n                type: string\n              interval:\n                description: The interval at which to check the Source for updates.\n                type: string\n              reconcileStrategy:\n                default: ChartVersion\n                description: Determines what enables the creation of a new artifact.\n                  Valid values are ('ChartVersion', 'Revision'). See the documentation\n                  of the values for an explanation on their behavior. Defaults to\n                  ChartVersion when omitted.\n                enum:\n                - ChartVersion\n                - Revision\n                type: string\n              sourceRef:\n                description: The reference to the Source the chart is available at.\n                properties:\n                  apiVersion:\n                    description: APIVersion of the referent.\n                    type: string\n                  kind:\n                    description: Kind of the referent, valid values are ('HelmRepository',\n                      'GitRepository', 'Bucket').\n                    enum:\n                    - HelmRepository\n                    - GitRepository\n                    - Bucket\n                    type: string\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - kind\n                - name\n                type: object\n              suspend:\n                description: This flag tells the controller to suspend the reconciliation\n                  of this source.\n                type: boolean\n              valuesFile:\n                description: Alternative values file to use as the default chart values,\n                  expected to be a relative path in the SourceRef. Deprecated in favor\n                  of ValuesFiles, for backwards compatibility the file defined here\n                  is merged before the ValuesFiles items. Ignored when omitted.\n                type: string\n              valuesFiles:\n                description: Alternative list of values files to use as the chart\n                  values (values.yaml is not included by default), expected to be\n                  a relative path in the SourceRef. Values files are merged in the\n                  order of this list with the last file overriding the first. Ignored\n                  when omitted.\n                items:\n                  type: string\n                type: array\n              version:\n                default: '*'\n                description: The chart version semver expression, ignored for charts\n                  from GitRepository and Bucket sources. Defaults to latest when omitted.\n                type: string\n            required:\n            - chart\n            - interval\n            - sourceRef\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: HelmChartStatus defines the observed state of the HelmChart.\n            properties:\n              artifact:\n                description: Artifact represents the output of the last successful\n                  chart sync.\n                properties:\n                  checksum:\n                    description: Checksum is the SHA256 checksum of the artifact.\n                    type: string\n                  lastUpdateTime:\n                    description: LastUpdateTime is the timestamp corresponding to\n                      the last update of this artifact.\n                    format: date-time\n                    type: string\n                  path:\n                    description: Path is the relative file path of this artifact.\n                    type: string\n                  revision:\n                    description: Revision is a human readable identifier traceable\n                      in the origin source system. It can be a Git commit SHA, Git\n                      tag, a Helm index timestamp, a Helm chart version, etc.\n                    type: string\n                  url:\n                    description: URL is the HTTP address of this artifact.\n                    type: string\n                required:\n                - path\n                - url\n                type: object\n              conditions:\n                description: Conditions holds the conditions for the HelmChart.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation.\n                format: int64\n                type: integer\n              url:\n                description: URL is the download link for the last chart pulled.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: false\n    subresources:\n      status: {}\n  - additionalPrinterColumns:\n    - jsonPath: .spec.chart\n      name: Chart\n      type: string\n    - jsonPath: .spec.version\n      name: Version\n      type: string\n    - jsonPath: .spec.sourceRef.kind\n      name: Source Kind\n      type: string\n    - jsonPath: .spec.sourceRef.name\n      name: Source Name\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v1beta2\n    schema:\n      openAPIV3Schema:\n        description: HelmChart is the Schema for the helmcharts API.\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: HelmChartSpec specifies the desired state of a Helm chart.\n            properties:\n              accessFrom:\n                description: 'AccessFrom specifies an Access Control List for allowing\n                  cross-namespace references to this object. NOTE: Not implemented,\n                  provisional as of https://github.com/fluxcd/flux2/pull/2092'\n                properties:\n                  namespaceSelectors:\n                    description: NamespaceSelectors is the list of namespace selectors\n                      to which this ACL applies. Items in this list are evaluated\n                      using a logical OR operation.\n                    items:\n                      description: NamespaceSelector selects the namespaces to which\n                        this ACL applies. An empty map of MatchLabels matches all\n                        namespaces in a cluster.\n                      properties:\n                        matchLabels:\n                          additionalProperties:\n                            type: string\n                          description: MatchLabels is a map of {key,value} pairs.\n                            A single {key,value} in the matchLabels map is equivalent\n                            to an element of matchExpressions, whose key field is\n                            \"key\", the operator is \"In\", and the values array contains\n                            only \"value\". The requirements are ANDed.\n                          type: object\n                      type: object\n                    type: array\n                required:\n                - namespaceSelectors\n                type: object\n              chart:\n                description: Chart is the name or path the Helm chart is available\n                  at in the SourceRef.\n                type: string\n              interval:\n                description: Interval is the interval at which to check the Source\n                  for updates.\n                type: string\n              reconcileStrategy:\n                default: ChartVersion\n                description: ReconcileStrategy determines what enables the creation\n                  of a new artifact. Valid values are ('ChartVersion', 'Revision').\n                  See the documentation of the values for an explanation on their\n                  behavior. Defaults to ChartVersion when omitted.\n                enum:\n                - ChartVersion\n                - Revision\n                type: string\n              sourceRef:\n                description: SourceRef is the reference to the Source the chart is\n                  available at.\n                properties:\n                  apiVersion:\n                    description: APIVersion of the referent.\n                    type: string\n                  kind:\n                    description: Kind of the referent, valid values are ('HelmRepository',\n                      'GitRepository', 'Bucket').\n                    enum:\n                    - HelmRepository\n                    - GitRepository\n                    - Bucket\n                    type: string\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - kind\n                - name\n                type: object\n              suspend:\n                description: Suspend tells the controller to suspend the reconciliation\n                  of this source.\n                type: boolean\n              valuesFile:\n                description: ValuesFile is an alternative values file to use as the\n                  default chart values, expected to be a relative path in the SourceRef.\n                  Deprecated in favor of ValuesFiles, for backwards compatibility\n                  the file specified here is merged before the ValuesFiles items.\n                  Ignored when omitted.\n                type: string\n              valuesFiles:\n                description: ValuesFiles is an alternative list of values files to\n                  use as the chart values (values.yaml is not included by default),\n                  expected to be a relative path in the SourceRef. Values files are\n                  merged in the order of this list with the last file overriding the\n                  first. Ignored when omitted.\n                items:\n                  type: string\n                type: array\n              version:\n                default: '*'\n                description: Version is the chart version semver expression, ignored\n                  for charts from GitRepository and Bucket sources. Defaults to latest\n                  when omitted.\n                type: string\n            required:\n            - chart\n            - interval\n            - sourceRef\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: HelmChartStatus records the observed state of the HelmChart.\n            properties:\n              artifact:\n                description: Artifact represents the output of the last successful\n                  reconciliation.\n                properties:\n                  checksum:\n                    description: Checksum is the SHA256 checksum of the Artifact file.\n                    type: string\n                  lastUpdateTime:\n                    description: LastUpdateTime is the timestamp corresponding to\n                      the last update of the Artifact.\n                    format: date-time\n                    type: string\n                  path:\n                    description: Path is the relative file path of the Artifact. It\n                      can be used to locate the file in the root of the Artifact storage\n                      on the local file system of the controller managing the Source.\n                    type: string\n                  revision:\n                    description: Revision is a human-readable identifier traceable\n                      in the origin source system. It can be a Git commit SHA, Git\n                      tag, a Helm chart version, etc.\n                    type: string\n                  size:\n                    description: Size is the number of bytes in the file.\n                    format: int64\n                    type: integer\n                  url:\n                    description: URL is the HTTP address of the Artifact as exposed\n                      by the controller managing the Source. It can be used to retrieve\n                      the Artifact for consumption, e.g. by another controller applying\n                      the Artifact contents.\n                    type: string\n                required:\n                - path\n                - url\n                type: object\n              conditions:\n                description: Conditions holds the conditions for the HelmChart.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedChartName:\n                description: ObservedChartName is the last observed chart name as\n                  specified by the resolved chart reference.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation of\n                  the HelmChart object.\n                format: int64\n                type: integer\n              observedSourceArtifactRevision:\n                description: ObservedSourceArtifactRevision is the last observed Artifact.Revision\n                  of the HelmChartSpec.SourceRef.\n                type: string\n              url:\n                description: URL is the dynamic fetch link for the latest Artifact.\n                  It is provided on a \"best effort\" basis, and using the precise BucketStatus.Artifact\n                  data is recommended.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []\n",
+            "yaml_incluster": "aad2c1c316d96f34f649fef444b0d0ecbc73ea02b5824b33285968dc05b6b41c"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "apiextensions.k8s.io/v1/customresourcedefinition/helmreleases.helm.toolkit.fluxcd.io",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "apiextensions.k8s.io/v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions/helmreleases.helm.toolkit.fluxcd.io",
+            "ignore_fields": null,
+            "kind": "CustomResourceDefinition",
+            "live_manifest_incluster": "d51b7c35b26ed986bcfa84ed08648f99ac676ee90faa8997907a1f02fdf9a93d",
+            "live_uid": "5233f278-5d43-4eb6-954e-bbe9b860f2bd",
+            "name": "helmreleases.helm.toolkit.fluxcd.io",
+            "namespace": null,
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "5233f278-5d43-4eb6-954e-bbe9b860f2bd",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: helmreleases.helm.toolkit.fluxcd.io\nspec:\n  group: helm.toolkit.fluxcd.io\n  names:\n    kind: HelmRelease\n    listKind: HelmReleaseList\n    plural: helmreleases\n    shortNames:\n    - hr\n    singular: helmrelease\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v2beta1\n    schema:\n      openAPIV3Schema:\n        description: HelmRelease is the Schema for the helmreleases API\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: HelmReleaseSpec defines the desired state of a Helm release.\n            properties:\n              chart:\n                description: Chart defines the template of the v1beta2.HelmChart that\n                  should be created for this HelmRelease.\n                properties:\n                  spec:\n                    description: Spec holds the template for the v1beta2.HelmChartSpec\n                      for this HelmRelease.\n                    properties:\n                      chart:\n                        description: The name or path the Helm chart is available\n                          at in the SourceRef.\n                        type: string\n                      interval:\n                        description: Interval at which to check the v1beta2.Source\n                          for updates. Defaults to 'HelmReleaseSpec.Interval'.\n                        type: string\n                      reconcileStrategy:\n                        default: ChartVersion\n                        description: Determines what enables the creation of a new\n                          artifact. Valid values are ('ChartVersion', 'Revision').\n                          See the documentation of the values for an explanation on\n                          their behavior. Defaults to ChartVersion when omitted.\n                        enum:\n                        - ChartVersion\n                        - Revision\n                        type: string\n                      sourceRef:\n                        description: The name and namespace of the v1beta2.Source\n                          the chart is available at.\n                        properties:\n                          apiVersion:\n                            description: APIVersion of the referent.\n                            type: string\n                          kind:\n                            description: Kind of the referent.\n                            enum:\n                            - HelmRepository\n                            - GitRepository\n                            - Bucket\n                            type: string\n                          name:\n                            description: Name of the referent.\n                            maxLength: 253\n                            minLength: 1\n                            type: string\n                          namespace:\n                            description: Namespace of the referent.\n                            maxLength: 63\n                            minLength: 1\n                            type: string\n                        required:\n                        - name\n                        type: object\n                      valuesFile:\n                        description: Alternative values file to use as the default\n                          chart values, expected to be a relative path in the SourceRef.\n                          Deprecated in favor of ValuesFiles, for backwards compatibility\n                          the file defined here is merged before the ValuesFiles items.\n                          Ignored when omitted.\n                        type: string\n                      valuesFiles:\n                        description: Alternative list of values files to use as the\n                          chart values (values.yaml is not included by default), expected\n                          to be a relative path in the SourceRef. Values files are\n                          merged in the order of this list with the last file overriding\n                          the first. Ignored when omitted.\n                        items:\n                          type: string\n                        type: array\n                      version:\n                        default: '*'\n                        description: Version semver expression, ignored for charts\n                          from v1beta2.GitRepository and v1beta2.Bucket sources. Defaults\n                          to latest when omitted.\n                        type: string\n                    required:\n                    - chart\n                    - sourceRef\n                    type: object\n                required:\n                - spec\n                type: object\n              dependsOn:\n                description: DependsOn may contain a meta.NamespacedObjectReference\n                  slice with references to HelmRelease resources that must be ready\n                  before this HelmRelease can be reconciled.\n                items:\n                  description: NamespacedObjectReference contains enough information\n                    to locate the referenced Kubernetes resource object in any namespace.\n                  properties:\n                    name:\n                      description: Name of the referent.\n                      type: string\n                    namespace:\n                      description: Namespace of the referent, when not specified it\n                        acts as LocalObjectReference.\n                      type: string\n                  required:\n                  - name\n                  type: object\n                type: array\n              install:\n                description: Install holds the configuration for Helm install actions\n                  for this HelmRelease.\n                properties:\n                  crds:\n                    description: \"CRDs upgrade CRDs from the Helm Chart's crds directory\n                      according to the CRD upgrade policy provided here. Valid values\n                      are `Skip`, `Create` or `CreateReplace`. Default is `Create`\n                      and if omitted CRDs are installed but not updated. \\n Skip:\n                      do neither install nor replace (update) any CRDs. \\n Create:\n                      new CRDs are created, existing CRDs are neither updated nor\n                      deleted. \\n CreateReplace: new CRDs are created, existing CRDs\n                      are updated (replaced) but not deleted. \\n By default, CRDs\n                      are applied (installed) during Helm install action. With this\n                      option users can opt-in to CRD replace existing CRDs on Helm\n                      install actions, which is not (yet) natively supported by Helm.\n                      https://helm.sh/docs/chart_best_practices/custom_resource_definitions.\"\n                    enum:\n                    - Skip\n                    - Create\n                    - CreateReplace\n                    type: string\n                  createNamespace:\n                    description: CreateNamespace tells the Helm install action to\n                      create the HelmReleaseSpec.TargetNamespace if it does not exist\n                      yet. On uninstall, the namespace will not be garbage collected.\n                    type: boolean\n                  disableHooks:\n                    description: DisableHooks prevents hooks from running during the\n                      Helm install action.\n                    type: boolean\n                  disableOpenAPIValidation:\n                    description: DisableOpenAPIValidation prevents the Helm install\n                      action from validating rendered templates against the Kubernetes\n                      OpenAPI Schema.\n                    type: boolean\n                  disableWait:\n                    description: DisableWait disables the waiting for resources to\n                      be ready after a Helm install has been performed.\n                    type: boolean\n                  disableWaitForJobs:\n                    description: DisableWaitForJobs disables waiting for jobs to complete\n                      after a Helm install has been performed.\n                    type: boolean\n                  remediation:\n                    description: Remediation holds the remediation configuration for\n                      when the Helm install action for the HelmRelease fails. The\n                      default is to not perform any action.\n                    properties:\n                      ignoreTestFailures:\n                        description: IgnoreTestFailures tells the controller to skip\n                          remediation when the Helm tests are run after an install\n                          action but fail. Defaults to 'Test.IgnoreFailures'.\n                        type: boolean\n                      remediateLastFailure:\n                        description: RemediateLastFailure tells the controller to\n                          remediate the last failure, when no retries remain. Defaults\n                          to 'false'.\n                        type: boolean\n                      retries:\n                        description: Retries is the number of retries that should\n                          be attempted on failures before bailing. Remediation, using\n                          an uninstall, is performed between each attempt. Defaults\n                          to '0', a negative integer equals to unlimited retries.\n                        type: integer\n                    type: object\n                  replace:\n                    description: Replace tells the Helm install action to re-use the\n                      'ReleaseName', but only if that name is a deleted release which\n                      remains in the history.\n                    type: boolean\n                  skipCRDs:\n                    description: \"SkipCRDs tells the Helm install action to not install\n                      any CRDs. By default, CRDs are installed if not already present.\n                      \\n Deprecated use CRD policy (`crds`) attribute with value `Skip`\n                      instead.\"\n                    type: boolean\n                  timeout:\n                    description: Timeout is the time to wait for any individual Kubernetes\n                      operation (like Jobs for hooks) during the performance of a\n                      Helm install action. Defaults to 'HelmReleaseSpec.Timeout'.\n                    type: string\n                type: object\n              interval:\n                description: Interval at which to reconcile the Helm release.\n                type: string\n              kubeConfig:\n                description: KubeConfig for reconciling the HelmRelease on a remote\n                  cluster. When used in combination with HelmReleaseSpec.ServiceAccountName,\n                  forces the controller to act on behalf of that Service Account at\n                  the target cluster. If the --default-service-account flag is set,\n                  its value will be used as a controller level fallback for when HelmReleaseSpec.ServiceAccountName\n                  is empty.\n                properties:\n                  secretRef:\n                    description: SecretRef holds the name to a secret that contains\n                      a key with the kubeconfig file as the value. If no key is specified\n                      the key will default to 'value'. The secret must be in the same\n                      namespace as the HelmRelease. It is recommended that the kubeconfig\n                      is self-contained, and the secret is regularly updated if credentials\n                      such as a cloud-access-token expire. Cloud specific `cmd-path`\n                      auth helpers will not function without adding binaries and credentials\n                      to the Pod that is responsible for reconciling the HelmRelease.\n                    properties:\n                      key:\n                        description: Key in the Secret, when not specified an implementation-specific\n                          default key is used.\n                        type: string\n                      name:\n                        description: Name of the Secret.\n                        type: string\n                    required:\n                    - name\n                    type: object\n                type: object\n              maxHistory:\n                description: MaxHistory is the number of revisions saved by Helm for\n                  this HelmRelease. Use '0' for an unlimited number of revisions;\n                  defaults to '10'.\n                type: integer\n              postRenderers:\n                description: PostRenderers holds an array of Helm PostRenderers, which\n                  will be applied in order of their definition.\n                items:\n                  description: PostRenderer contains a Helm PostRenderer specification.\n                  properties:\n                    kustomize:\n                      description: Kustomization to apply as PostRenderer.\n                      properties:\n                        images:\n                          description: Images is a list of (image name, new name,\n                            new tag or digest) for changing image names, tags or digests.\n                            This can also be achieved with a patch, but this operator\n                            is simpler to specify.\n                          items:\n                            description: Image contains an image name, a new name,\n                              a new tag or digest, which will replace the original\n                              name and tag.\n                            properties:\n                              digest:\n                                description: Digest is the value used to replace the\n                                  original image tag. If digest is present NewTag\n                                  value is ignored.\n                                type: string\n                              name:\n                                description: Name is a tag-less image name.\n                                type: string\n                              newName:\n                                description: NewName is the value used to replace\n                                  the original name.\n                                type: string\n                              newTag:\n                                description: NewTag is the value used to replace the\n                                  original tag.\n                                type: string\n                            required:\n                            - name\n                            type: object\n                          type: array\n                        patches:\n                          description: Strategic merge and JSON patches, defined as\n                            inline YAML objects, capable of targeting objects based\n                            on kind, label and annotation selectors.\n                          items:\n                            description: Patch contains an inline StrategicMerge or\n                              JSON6902 patch, and the target the patch should be applied\n                              to.\n                            properties:\n                              patch:\n                                description: Patch contains an inline StrategicMerge\n                                  patch or an inline JSON6902 patch with an array\n                                  of operation objects.\n                                type: string\n                              target:\n                                description: Target points to the resources that the\n                                  patch document should be applied to.\n                                properties:\n                                  annotationSelector:\n                                    description: AnnotationSelector is a string that\n                                      follows the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                                      It matches with the resource annotations.\n                                    type: string\n                                  group:\n                                    description: Group is the API group to select\n                                      resources from. Together with Version and Kind\n                                      it is capable of unambiguously identifying and/or\n                                      selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                                    type: string\n                                  kind:\n                                    description: Kind of the API Group to select resources\n                                      from. Together with Group and Version it is\n                                      capable of unambiguously identifying and/or\n                                      selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                                    type: string\n                                  labelSelector:\n                                    description: LabelSelector is a string that follows\n                                      the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                                      It matches with the resource labels.\n                                    type: string\n                                  name:\n                                    description: Name to match resources with.\n                                    type: string\n                                  namespace:\n                                    description: Namespace to select resources from.\n                                    type: string\n                                  version:\n                                    description: Version of the API Group to select\n                                      resources from. Together with Group and Kind\n                                      it is capable of unambiguously identifying and/or\n                                      selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                                    type: string\n                                type: object\n                            type: object\n                          type: array\n                        patchesJson6902:\n                          description: JSON 6902 patches, defined as inline YAML objects.\n                          items:\n                            description: JSON6902Patch contains a JSON6902 patch and\n                              the target the patch should be applied to.\n                            properties:\n                              patch:\n                                description: Patch contains the JSON6902 patch document\n                                  with an array of operation objects.\n                                items:\n                                  description: JSON6902 is a JSON6902 operation object.\n                                    https://datatracker.ietf.org/doc/html/rfc6902#section-4\n                                  properties:\n                                    from:\n                                      description: From contains a JSON-pointer value\n                                        that references a location within the target\n                                        document where the operation is performed.\n                                        The meaning of the value depends on the value\n                                        of Op, and is NOT taken into account by all\n                                        operations.\n                                      type: string\n                                    op:\n                                      description: Op indicates the operation to perform.\n                                        Its value MUST be one of \"add\", \"remove\",\n                                        \"replace\", \"move\", \"copy\", or \"test\". https://datatracker.ietf.org/doc/html/rfc6902#section-4\n                                      enum:\n                                      - test\n                                      - remove\n                                      - add\n                                      - replace\n                                      - move\n                                      - copy\n                                      type: string\n                                    path:\n                                      description: Path contains the JSON-pointer\n                                        value that references a location within the\n                                        target document where the operation is performed.\n                                        The meaning of the value depends on the value\n                                        of Op.\n                                      type: string\n                                    value:\n                                      description: Value contains a valid JSON structure.\n                                        The meaning of the value depends on the value\n                                        of Op, and is NOT taken into account by all\n                                        operations.\n                                      x-kubernetes-preserve-unknown-fields: true\n                                  required:\n                                  - op\n                                  - path\n                                  type: object\n                                type: array\n                              target:\n                                description: Target points to the resources that the\n                                  patch document should be applied to.\n                                properties:\n                                  annotationSelector:\n                                    description: AnnotationSelector is a string that\n                                      follows the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                                      It matches with the resource annotations.\n                                    type: string\n                                  group:\n                                    description: Group is the API group to select\n                                      resources from. Together with Version and Kind\n                                      it is capable of unambiguously identifying and/or\n                                      selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                                    type: string\n                                  kind:\n                                    description: Kind of the API Group to select resources\n                                      from. Together with Group and Version it is\n                                      capable of unambiguously identifying and/or\n                                      selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                                    type: string\n                                  labelSelector:\n                                    description: LabelSelector is a string that follows\n                                      the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                                      It matches with the resource labels.\n                                    type: string\n                                  name:\n                                    description: Name to match resources with.\n                                    type: string\n                                  namespace:\n                                    description: Namespace to select resources from.\n                                    type: string\n                                  version:\n                                    description: Version of the API Group to select\n                                      resources from. Together with Group and Kind\n                                      it is capable of unambiguously identifying and/or\n                                      selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                                    type: string\n                                type: object\n                            required:\n                            - patch\n                            - target\n                            type: object\n                          type: array\n                        patchesStrategicMerge:\n                          description: Strategic merge patches, defined as inline\n                            YAML objects.\n                          items:\n                            x-kubernetes-preserve-unknown-fields: true\n                          type: array\n                      type: object\n                  type: object\n                type: array\n              releaseName:\n                description: ReleaseName used for the Helm release. Defaults to a\n                  composition of '[TargetNamespace-]Name'.\n                maxLength: 53\n                minLength: 1\n                type: string\n              rollback:\n                description: Rollback holds the configuration for Helm rollback actions\n                  for this HelmRelease.\n                properties:\n                  cleanupOnFail:\n                    description: CleanupOnFail allows deletion of new resources created\n                      during the Helm rollback action when it fails.\n                    type: boolean\n                  disableHooks:\n                    description: DisableHooks prevents hooks from running during the\n                      Helm rollback action.\n                    type: boolean\n                  disableWait:\n                    description: DisableWait disables the waiting for resources to\n                      be ready after a Helm rollback has been performed.\n                    type: boolean\n                  disableWaitForJobs:\n                    description: DisableWaitForJobs disables waiting for jobs to complete\n                      after a Helm rollback has been performed.\n                    type: boolean\n                  force:\n                    description: Force forces resource updates through a replacement\n                      strategy.\n                    type: boolean\n                  recreate:\n                    description: Recreate performs pod restarts for the resource if\n                      applicable.\n                    type: boolean\n                  timeout:\n                    description: Timeout is the time to wait for any individual Kubernetes\n                      operation (like Jobs for hooks) during the performance of a\n                      Helm rollback action. Defaults to 'HelmReleaseSpec.Timeout'.\n                    type: string\n                type: object\n              serviceAccountName:\n                description: The name of the Kubernetes service account to impersonate\n                  when reconciling this HelmRelease.\n                type: string\n              storageNamespace:\n                description: StorageNamespace used for the Helm storage. Defaults\n                  to the namespace of the HelmRelease.\n                maxLength: 63\n                minLength: 1\n                type: string\n              suspend:\n                description: Suspend tells the controller to suspend reconciliation\n                  for this HelmRelease, it does not apply to already started reconciliations.\n                  Defaults to false.\n                type: boolean\n              targetNamespace:\n                description: TargetNamespace to target when performing operations\n                  for the HelmRelease. Defaults to the namespace of the HelmRelease.\n                maxLength: 63\n                minLength: 1\n                type: string\n              test:\n                description: Test holds the configuration for Helm test actions for\n                  this HelmRelease.\n                properties:\n                  enable:\n                    description: Enable enables Helm test actions for this HelmRelease\n                      after an Helm install or upgrade action has been performed.\n                    type: boolean\n                  ignoreFailures:\n                    description: IgnoreFailures tells the controller to skip remediation\n                      when the Helm tests are run but fail. Can be overwritten for\n                      tests run after install or upgrade actions in 'Install.IgnoreTestFailures'\n                      and 'Upgrade.IgnoreTestFailures'.\n                    type: boolean\n                  timeout:\n                    description: Timeout is the time to wait for any individual Kubernetes\n                      operation during the performance of a Helm test action. Defaults\n                      to 'HelmReleaseSpec.Timeout'.\n                    type: string\n                type: object\n              timeout:\n                description: Timeout is the time to wait for any individual Kubernetes\n                  operation (like Jobs for hooks) during the performance of a Helm\n                  action. Defaults to '5m0s'.\n                type: string\n              uninstall:\n                description: Uninstall holds the configuration for Helm uninstall\n                  actions for this HelmRelease.\n                properties:\n                  disableHooks:\n                    description: DisableHooks prevents hooks from running during the\n                      Helm rollback action.\n                    type: boolean\n                  disableWait:\n                    description: DisableWait disables waiting for all the resources\n                      to be deleted after a Helm uninstall is performed.\n                    type: boolean\n                  keepHistory:\n                    description: KeepHistory tells Helm to remove all associated resources\n                      and mark the release as deleted, but retain the release history.\n                    type: boolean\n                  timeout:\n                    description: Timeout is the time to wait for any individual Kubernetes\n                      operation (like Jobs for hooks) during the performance of a\n                      Helm uninstall action. Defaults to 'HelmReleaseSpec.Timeout'.\n                    type: string\n                type: object\n              upgrade:\n                description: Upgrade holds the configuration for Helm upgrade actions\n                  for this HelmRelease.\n                properties:\n                  cleanupOnFail:\n                    description: CleanupOnFail allows deletion of new resources created\n                      during the Helm upgrade action when it fails.\n                    type: boolean\n                  crds:\n                    description: \"CRDs upgrade CRDs from the Helm Chart's crds directory\n                      according to the CRD upgrade policy provided here. Valid values\n                      are `Skip`, `Create` or `CreateReplace`. Default is `Skip` and\n                      if omitted CRDs are neither installed nor upgraded. \\n Skip:\n                      do neither install nor replace (update) any CRDs. \\n Create:\n                      new CRDs are created, existing CRDs are neither updated nor\n                      deleted. \\n CreateReplace: new CRDs are created, existing CRDs\n                      are updated (replaced) but not deleted. \\n By default, CRDs\n                      are not applied during Helm upgrade action. With this option\n                      users can opt-in to CRD upgrade, which is not (yet) natively\n                      supported by Helm. https://helm.sh/docs/chart_best_practices/custom_resource_definitions.\"\n                    enum:\n                    - Skip\n                    - Create\n                    - CreateReplace\n                    type: string\n                  disableHooks:\n                    description: DisableHooks prevents hooks from running during the\n                      Helm upgrade action.\n                    type: boolean\n                  disableOpenAPIValidation:\n                    description: DisableOpenAPIValidation prevents the Helm upgrade\n                      action from validating rendered templates against the Kubernetes\n                      OpenAPI Schema.\n                    type: boolean\n                  disableWait:\n                    description: DisableWait disables the waiting for resources to\n                      be ready after a Helm upgrade has been performed.\n                    type: boolean\n                  disableWaitForJobs:\n                    description: DisableWaitForJobs disables waiting for jobs to complete\n                      after a Helm upgrade has been performed.\n                    type: boolean\n                  force:\n                    description: Force forces resource updates through a replacement\n                      strategy.\n                    type: boolean\n                  preserveValues:\n                    description: PreserveValues will make Helm reuse the last release's\n                      values and merge in overrides from 'Values'. Setting this flag\n                      makes the HelmRelease non-declarative.\n                    type: boolean\n                  remediation:\n                    description: Remediation holds the remediation configuration for\n                      when the Helm upgrade action for the HelmRelease fails. The\n                      default is to not perform any action.\n                    properties:\n                      ignoreTestFailures:\n                        description: IgnoreTestFailures tells the controller to skip\n                          remediation when the Helm tests are run after an upgrade\n                          action but fail. Defaults to 'Test.IgnoreFailures'.\n                        type: boolean\n                      remediateLastFailure:\n                        description: RemediateLastFailure tells the controller to\n                          remediate the last failure, when no retries remain. Defaults\n                          to 'false' unless 'Retries' is greater than 0.\n                        type: boolean\n                      retries:\n                        description: Retries is the number of retries that should\n                          be attempted on failures before bailing. Remediation, using\n                          'Strategy', is performed between each attempt. Defaults\n                          to '0', a negative integer equals to unlimited retries.\n                        type: integer\n                      strategy:\n                        description: Strategy to use for failure remediation. Defaults\n                          to 'rollback'.\n                        enum:\n                        - rollback\n                        - uninstall\n                        type: string\n                    type: object\n                  timeout:\n                    description: Timeout is the time to wait for any individual Kubernetes\n                      operation (like Jobs for hooks) during the performance of a\n                      Helm upgrade action. Defaults to 'HelmReleaseSpec.Timeout'.\n                    type: string\n                type: object\n              values:\n                description: Values holds the values for this Helm release.\n                x-kubernetes-preserve-unknown-fields: true\n              valuesFrom:\n                description: ValuesFrom holds references to resources containing Helm\n                  values for this HelmRelease, and information about how they should\n                  be merged.\n                items:\n                  description: ValuesReference contains a reference to a resource\n                    containing Helm values, and optionally the key they can be found\n                    at.\n                  properties:\n                    kind:\n                      description: Kind of the values referent, valid values are ('Secret',\n                        'ConfigMap').\n                      enum:\n                      - Secret\n                      - ConfigMap\n                      type: string\n                    name:\n                      description: Name of the values referent. Should reside in the\n                        same namespace as the referring resource.\n                      maxLength: 253\n                      minLength: 1\n                      type: string\n                    optional:\n                      description: Optional marks this ValuesReference as optional.\n                        When set, a not found error for the values reference is ignored,\n                        but any ValuesKey, TargetPath or transient error will still\n                        result in a reconciliation failure.\n                      type: boolean\n                    targetPath:\n                      description: TargetPath is the YAML dot notation path the value\n                        should be merged at. When set, the ValuesKey is expected to\n                        be a single flat value. Defaults to 'None', which results\n                        in the values getting merged at the root.\n                      type: string\n                    valuesKey:\n                      description: ValuesKey is the data key where the values.yaml\n                        or a specific value can be found at. Defaults to 'values.yaml'.\n                      type: string\n                  required:\n                  - kind\n                  - name\n                  type: object\n                type: array\n            required:\n            - chart\n            - interval\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: HelmReleaseStatus defines the observed state of a HelmRelease.\n            properties:\n              conditions:\n                description: Conditions holds the conditions for the HelmRelease.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              failures:\n                description: Failures is the reconciliation failure count against\n                  the latest desired state. It is reset after a successful reconciliation.\n                format: int64\n                type: integer\n              helmChart:\n                description: HelmChart is the namespaced name of the HelmChart resource\n                  created by the controller for the HelmRelease.\n                type: string\n              installFailures:\n                description: InstallFailures is the install failure count against\n                  the latest desired state. It is reset after a successful reconciliation.\n                format: int64\n                type: integer\n              lastAppliedRevision:\n                description: LastAppliedRevision is the revision of the last successfully\n                  applied source.\n                type: string\n              lastAttemptedRevision:\n                description: LastAttemptedRevision is the revision of the last reconciliation\n                  attempt.\n                type: string\n              lastAttemptedValuesChecksum:\n                description: LastAttemptedValuesChecksum is the SHA1 checksum of the\n                  values of the last reconciliation attempt.\n                type: string\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              lastReleaseRevision:\n                description: LastReleaseRevision is the revision of the last successful\n                  Helm release.\n                type: integer\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation.\n                format: int64\n                type: integer\n              upgradeFailures:\n                description: UpgradeFailures is the upgrade failure count against\n                  the latest desired state. It is reset after a successful reconciliation.\n                format: int64\n                type: integer\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []",
+            "yaml_body_parsed": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: helmreleases.helm.toolkit.fluxcd.io\nspec:\n  group: helm.toolkit.fluxcd.io\n  names:\n    kind: HelmRelease\n    listKind: HelmReleaseList\n    plural: helmreleases\n    shortNames:\n    - hr\n    singular: helmrelease\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v2beta1\n    schema:\n      openAPIV3Schema:\n        description: HelmRelease is the Schema for the helmreleases API\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: HelmReleaseSpec defines the desired state of a Helm release.\n            properties:\n              chart:\n                description: Chart defines the template of the v1beta2.HelmChart that\n                  should be created for this HelmRelease.\n                properties:\n                  spec:\n                    description: Spec holds the template for the v1beta2.HelmChartSpec\n                      for this HelmRelease.\n                    properties:\n                      chart:\n                        description: The name or path the Helm chart is available\n                          at in the SourceRef.\n                        type: string\n                      interval:\n                        description: Interval at which to check the v1beta2.Source\n                          for updates. Defaults to 'HelmReleaseSpec.Interval'.\n                        type: string\n                      reconcileStrategy:\n                        default: ChartVersion\n                        description: Determines what enables the creation of a new\n                          artifact. Valid values are ('ChartVersion', 'Revision').\n                          See the documentation of the values for an explanation on\n                          their behavior. Defaults to ChartVersion when omitted.\n                        enum:\n                        - ChartVersion\n                        - Revision\n                        type: string\n                      sourceRef:\n                        description: The name and namespace of the v1beta2.Source\n                          the chart is available at.\n                        properties:\n                          apiVersion:\n                            description: APIVersion of the referent.\n                            type: string\n                          kind:\n                            description: Kind of the referent.\n                            enum:\n                            - HelmRepository\n                            - GitRepository\n                            - Bucket\n                            type: string\n                          name:\n                            description: Name of the referent.\n                            maxLength: 253\n                            minLength: 1\n                            type: string\n                          namespace:\n                            description: Namespace of the referent.\n                            maxLength: 63\n                            minLength: 1\n                            type: string\n                        required:\n                        - name\n                        type: object\n                      valuesFile:\n                        description: Alternative values file to use as the default\n                          chart values, expected to be a relative path in the SourceRef.\n                          Deprecated in favor of ValuesFiles, for backwards compatibility\n                          the file defined here is merged before the ValuesFiles items.\n                          Ignored when omitted.\n                        type: string\n                      valuesFiles:\n                        description: Alternative list of values files to use as the\n                          chart values (values.yaml is not included by default), expected\n                          to be a relative path in the SourceRef. Values files are\n                          merged in the order of this list with the last file overriding\n                          the first. Ignored when omitted.\n                        items:\n                          type: string\n                        type: array\n                      version:\n                        default: '*'\n                        description: Version semver expression, ignored for charts\n                          from v1beta2.GitRepository and v1beta2.Bucket sources. Defaults\n                          to latest when omitted.\n                        type: string\n                    required:\n                    - chart\n                    - sourceRef\n                    type: object\n                required:\n                - spec\n                type: object\n              dependsOn:\n                description: DependsOn may contain a meta.NamespacedObjectReference\n                  slice with references to HelmRelease resources that must be ready\n                  before this HelmRelease can be reconciled.\n                items:\n                  description: NamespacedObjectReference contains enough information\n                    to locate the referenced Kubernetes resource object in any namespace.\n                  properties:\n                    name:\n                      description: Name of the referent.\n                      type: string\n                    namespace:\n                      description: Namespace of the referent, when not specified it\n                        acts as LocalObjectReference.\n                      type: string\n                  required:\n                  - name\n                  type: object\n                type: array\n              install:\n                description: Install holds the configuration for Helm install actions\n                  for this HelmRelease.\n                properties:\n                  crds:\n                    description: \"CRDs upgrade CRDs from the Helm Chart's crds directory\n                      according to the CRD upgrade policy provided here. Valid values\n                      are `Skip`, `Create` or `CreateReplace`. Default is `Create`\n                      and if omitted CRDs are installed but not updated. \\n Skip:\n                      do neither install nor replace (update) any CRDs. \\n Create:\n                      new CRDs are created, existing CRDs are neither updated nor\n                      deleted. \\n CreateReplace: new CRDs are created, existing CRDs\n                      are updated (replaced) but not deleted. \\n By default, CRDs\n                      are applied (installed) during Helm install action. With this\n                      option users can opt-in to CRD replace existing CRDs on Helm\n                      install actions, which is not (yet) natively supported by Helm.\n                      https://helm.sh/docs/chart_best_practices/custom_resource_definitions.\"\n                    enum:\n                    - Skip\n                    - Create\n                    - CreateReplace\n                    type: string\n                  createNamespace:\n                    description: CreateNamespace tells the Helm install action to\n                      create the HelmReleaseSpec.TargetNamespace if it does not exist\n                      yet. On uninstall, the namespace will not be garbage collected.\n                    type: boolean\n                  disableHooks:\n                    description: DisableHooks prevents hooks from running during the\n                      Helm install action.\n                    type: boolean\n                  disableOpenAPIValidation:\n                    description: DisableOpenAPIValidation prevents the Helm install\n                      action from validating rendered templates against the Kubernetes\n                      OpenAPI Schema.\n                    type: boolean\n                  disableWait:\n                    description: DisableWait disables the waiting for resources to\n                      be ready after a Helm install has been performed.\n                    type: boolean\n                  disableWaitForJobs:\n                    description: DisableWaitForJobs disables waiting for jobs to complete\n                      after a Helm install has been performed.\n                    type: boolean\n                  remediation:\n                    description: Remediation holds the remediation configuration for\n                      when the Helm install action for the HelmRelease fails. The\n                      default is to not perform any action.\n                    properties:\n                      ignoreTestFailures:\n                        description: IgnoreTestFailures tells the controller to skip\n                          remediation when the Helm tests are run after an install\n                          action but fail. Defaults to 'Test.IgnoreFailures'.\n                        type: boolean\n                      remediateLastFailure:\n                        description: RemediateLastFailure tells the controller to\n                          remediate the last failure, when no retries remain. Defaults\n                          to 'false'.\n                        type: boolean\n                      retries:\n                        description: Retries is the number of retries that should\n                          be attempted on failures before bailing. Remediation, using\n                          an uninstall, is performed between each attempt. Defaults\n                          to '0', a negative integer equals to unlimited retries.\n                        type: integer\n                    type: object\n                  replace:\n                    description: Replace tells the Helm install action to re-use the\n                      'ReleaseName', but only if that name is a deleted release which\n                      remains in the history.\n                    type: boolean\n                  skipCRDs:\n                    description: \"SkipCRDs tells the Helm install action to not install\n                      any CRDs. By default, CRDs are installed if not already present.\n                      \\n Deprecated use CRD policy (`crds`) attribute with value `Skip`\n                      instead.\"\n                    type: boolean\n                  timeout:\n                    description: Timeout is the time to wait for any individual Kubernetes\n                      operation (like Jobs for hooks) during the performance of a\n                      Helm install action. Defaults to 'HelmReleaseSpec.Timeout'.\n                    type: string\n                type: object\n              interval:\n                description: Interval at which to reconcile the Helm release.\n                type: string\n              kubeConfig:\n                description: KubeConfig for reconciling the HelmRelease on a remote\n                  cluster. When used in combination with HelmReleaseSpec.ServiceAccountName,\n                  forces the controller to act on behalf of that Service Account at\n                  the target cluster. If the --default-service-account flag is set,\n                  its value will be used as a controller level fallback for when HelmReleaseSpec.ServiceAccountName\n                  is empty.\n                properties:\n                  secretRef:\n                    description: SecretRef holds the name to a secret that contains\n                      a key with the kubeconfig file as the value. If no key is specified\n                      the key will default to 'value'. The secret must be in the same\n                      namespace as the HelmRelease. It is recommended that the kubeconfig\n                      is self-contained, and the secret is regularly updated if credentials\n                      such as a cloud-access-token expire. Cloud specific `cmd-path`\n                      auth helpers will not function without adding binaries and credentials\n                      to the Pod that is responsible for reconciling the HelmRelease.\n                    properties:\n                      key:\n                        description: Key in the Secret, when not specified an implementation-specific\n                          default key is used.\n                        type: string\n                      name:\n                        description: Name of the Secret.\n                        type: string\n                    required:\n                    - name\n                    type: object\n                type: object\n              maxHistory:\n                description: MaxHistory is the number of revisions saved by Helm for\n                  this HelmRelease. Use '0' for an unlimited number of revisions;\n                  defaults to '10'.\n                type: integer\n              postRenderers:\n                description: PostRenderers holds an array of Helm PostRenderers, which\n                  will be applied in order of their definition.\n                items:\n                  description: PostRenderer contains a Helm PostRenderer specification.\n                  properties:\n                    kustomize:\n                      description: Kustomization to apply as PostRenderer.\n                      properties:\n                        images:\n                          description: Images is a list of (image name, new name,\n                            new tag or digest) for changing image names, tags or digests.\n                            This can also be achieved with a patch, but this operator\n                            is simpler to specify.\n                          items:\n                            description: Image contains an image name, a new name,\n                              a new tag or digest, which will replace the original\n                              name and tag.\n                            properties:\n                              digest:\n                                description: Digest is the value used to replace the\n                                  original image tag. If digest is present NewTag\n                                  value is ignored.\n                                type: string\n                              name:\n                                description: Name is a tag-less image name.\n                                type: string\n                              newName:\n                                description: NewName is the value used to replace\n                                  the original name.\n                                type: string\n                              newTag:\n                                description: NewTag is the value used to replace the\n                                  original tag.\n                                type: string\n                            required:\n                            - name\n                            type: object\n                          type: array\n                        patches:\n                          description: Strategic merge and JSON patches, defined as\n                            inline YAML objects, capable of targeting objects based\n                            on kind, label and annotation selectors.\n                          items:\n                            description: Patch contains an inline StrategicMerge or\n                              JSON6902 patch, and the target the patch should be applied\n                              to.\n                            properties:\n                              patch:\n                                description: Patch contains an inline StrategicMerge\n                                  patch or an inline JSON6902 patch with an array\n                                  of operation objects.\n                                type: string\n                              target:\n                                description: Target points to the resources that the\n                                  patch document should be applied to.\n                                properties:\n                                  annotationSelector:\n                                    description: AnnotationSelector is a string that\n                                      follows the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                                      It matches with the resource annotations.\n                                    type: string\n                                  group:\n                                    description: Group is the API group to select\n                                      resources from. Together with Version and Kind\n                                      it is capable of unambiguously identifying and/or\n                                      selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                                    type: string\n                                  kind:\n                                    description: Kind of the API Group to select resources\n                                      from. Together with Group and Version it is\n                                      capable of unambiguously identifying and/or\n                                      selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                                    type: string\n                                  labelSelector:\n                                    description: LabelSelector is a string that follows\n                                      the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                                      It matches with the resource labels.\n                                    type: string\n                                  name:\n                                    description: Name to match resources with.\n                                    type: string\n                                  namespace:\n                                    description: Namespace to select resources from.\n                                    type: string\n                                  version:\n                                    description: Version of the API Group to select\n                                      resources from. Together with Group and Kind\n                                      it is capable of unambiguously identifying and/or\n                                      selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                                    type: string\n                                type: object\n                            type: object\n                          type: array\n                        patchesJson6902:\n                          description: JSON 6902 patches, defined as inline YAML objects.\n                          items:\n                            description: JSON6902Patch contains a JSON6902 patch and\n                              the target the patch should be applied to.\n                            properties:\n                              patch:\n                                description: Patch contains the JSON6902 patch document\n                                  with an array of operation objects.\n                                items:\n                                  description: JSON6902 is a JSON6902 operation object.\n                                    https://datatracker.ietf.org/doc/html/rfc6902#section-4\n                                  properties:\n                                    from:\n                                      description: From contains a JSON-pointer value\n                                        that references a location within the target\n                                        document where the operation is performed.\n                                        The meaning of the value depends on the value\n                                        of Op, and is NOT taken into account by all\n                                        operations.\n                                      type: string\n                                    op:\n                                      description: Op indicates the operation to perform.\n                                        Its value MUST be one of \"add\", \"remove\",\n                                        \"replace\", \"move\", \"copy\", or \"test\". https://datatracker.ietf.org/doc/html/rfc6902#section-4\n                                      enum:\n                                      - test\n                                      - remove\n                                      - add\n                                      - replace\n                                      - move\n                                      - copy\n                                      type: string\n                                    path:\n                                      description: Path contains the JSON-pointer\n                                        value that references a location within the\n                                        target document where the operation is performed.\n                                        The meaning of the value depends on the value\n                                        of Op.\n                                      type: string\n                                    value:\n                                      description: Value contains a valid JSON structure.\n                                        The meaning of the value depends on the value\n                                        of Op, and is NOT taken into account by all\n                                        operations.\n                                      x-kubernetes-preserve-unknown-fields: true\n                                  required:\n                                  - op\n                                  - path\n                                  type: object\n                                type: array\n                              target:\n                                description: Target points to the resources that the\n                                  patch document should be applied to.\n                                properties:\n                                  annotationSelector:\n                                    description: AnnotationSelector is a string that\n                                      follows the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                                      It matches with the resource annotations.\n                                    type: string\n                                  group:\n                                    description: Group is the API group to select\n                                      resources from. Together with Version and Kind\n                                      it is capable of unambiguously identifying and/or\n                                      selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                                    type: string\n                                  kind:\n                                    description: Kind of the API Group to select resources\n                                      from. Together with Group and Version it is\n                                      capable of unambiguously identifying and/or\n                                      selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                                    type: string\n                                  labelSelector:\n                                    description: LabelSelector is a string that follows\n                                      the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                                      It matches with the resource labels.\n                                    type: string\n                                  name:\n                                    description: Name to match resources with.\n                                    type: string\n                                  namespace:\n                                    description: Namespace to select resources from.\n                                    type: string\n                                  version:\n                                    description: Version of the API Group to select\n                                      resources from. Together with Group and Kind\n                                      it is capable of unambiguously identifying and/or\n                                      selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                                    type: string\n                                type: object\n                            required:\n                            - patch\n                            - target\n                            type: object\n                          type: array\n                        patchesStrategicMerge:\n                          description: Strategic merge patches, defined as inline\n                            YAML objects.\n                          items:\n                            x-kubernetes-preserve-unknown-fields: true\n                          type: array\n                      type: object\n                  type: object\n                type: array\n              releaseName:\n                description: ReleaseName used for the Helm release. Defaults to a\n                  composition of '[TargetNamespace-]Name'.\n                maxLength: 53\n                minLength: 1\n                type: string\n              rollback:\n                description: Rollback holds the configuration for Helm rollback actions\n                  for this HelmRelease.\n                properties:\n                  cleanupOnFail:\n                    description: CleanupOnFail allows deletion of new resources created\n                      during the Helm rollback action when it fails.\n                    type: boolean\n                  disableHooks:\n                    description: DisableHooks prevents hooks from running during the\n                      Helm rollback action.\n                    type: boolean\n                  disableWait:\n                    description: DisableWait disables the waiting for resources to\n                      be ready after a Helm rollback has been performed.\n                    type: boolean\n                  disableWaitForJobs:\n                    description: DisableWaitForJobs disables waiting for jobs to complete\n                      after a Helm rollback has been performed.\n                    type: boolean\n                  force:\n                    description: Force forces resource updates through a replacement\n                      strategy.\n                    type: boolean\n                  recreate:\n                    description: Recreate performs pod restarts for the resource if\n                      applicable.\n                    type: boolean\n                  timeout:\n                    description: Timeout is the time to wait for any individual Kubernetes\n                      operation (like Jobs for hooks) during the performance of a\n                      Helm rollback action. Defaults to 'HelmReleaseSpec.Timeout'.\n                    type: string\n                type: object\n              serviceAccountName:\n                description: The name of the Kubernetes service account to impersonate\n                  when reconciling this HelmRelease.\n                type: string\n              storageNamespace:\n                description: StorageNamespace used for the Helm storage. Defaults\n                  to the namespace of the HelmRelease.\n                maxLength: 63\n                minLength: 1\n                type: string\n              suspend:\n                description: Suspend tells the controller to suspend reconciliation\n                  for this HelmRelease, it does not apply to already started reconciliations.\n                  Defaults to false.\n                type: boolean\n              targetNamespace:\n                description: TargetNamespace to target when performing operations\n                  for the HelmRelease. Defaults to the namespace of the HelmRelease.\n                maxLength: 63\n                minLength: 1\n                type: string\n              test:\n                description: Test holds the configuration for Helm test actions for\n                  this HelmRelease.\n                properties:\n                  enable:\n                    description: Enable enables Helm test actions for this HelmRelease\n                      after an Helm install or upgrade action has been performed.\n                    type: boolean\n                  ignoreFailures:\n                    description: IgnoreFailures tells the controller to skip remediation\n                      when the Helm tests are run but fail. Can be overwritten for\n                      tests run after install or upgrade actions in 'Install.IgnoreTestFailures'\n                      and 'Upgrade.IgnoreTestFailures'.\n                    type: boolean\n                  timeout:\n                    description: Timeout is the time to wait for any individual Kubernetes\n                      operation during the performance of a Helm test action. Defaults\n                      to 'HelmReleaseSpec.Timeout'.\n                    type: string\n                type: object\n              timeout:\n                description: Timeout is the time to wait for any individual Kubernetes\n                  operation (like Jobs for hooks) during the performance of a Helm\n                  action. Defaults to '5m0s'.\n                type: string\n              uninstall:\n                description: Uninstall holds the configuration for Helm uninstall\n                  actions for this HelmRelease.\n                properties:\n                  disableHooks:\n                    description: DisableHooks prevents hooks from running during the\n                      Helm rollback action.\n                    type: boolean\n                  disableWait:\n                    description: DisableWait disables waiting for all the resources\n                      to be deleted after a Helm uninstall is performed.\n                    type: boolean\n                  keepHistory:\n                    description: KeepHistory tells Helm to remove all associated resources\n                      and mark the release as deleted, but retain the release history.\n                    type: boolean\n                  timeout:\n                    description: Timeout is the time to wait for any individual Kubernetes\n                      operation (like Jobs for hooks) during the performance of a\n                      Helm uninstall action. Defaults to 'HelmReleaseSpec.Timeout'.\n                    type: string\n                type: object\n              upgrade:\n                description: Upgrade holds the configuration for Helm upgrade actions\n                  for this HelmRelease.\n                properties:\n                  cleanupOnFail:\n                    description: CleanupOnFail allows deletion of new resources created\n                      during the Helm upgrade action when it fails.\n                    type: boolean\n                  crds:\n                    description: \"CRDs upgrade CRDs from the Helm Chart's crds directory\n                      according to the CRD upgrade policy provided here. Valid values\n                      are `Skip`, `Create` or `CreateReplace`. Default is `Skip` and\n                      if omitted CRDs are neither installed nor upgraded. \\n Skip:\n                      do neither install nor replace (update) any CRDs. \\n Create:\n                      new CRDs are created, existing CRDs are neither updated nor\n                      deleted. \\n CreateReplace: new CRDs are created, existing CRDs\n                      are updated (replaced) but not deleted. \\n By default, CRDs\n                      are not applied during Helm upgrade action. With this option\n                      users can opt-in to CRD upgrade, which is not (yet) natively\n                      supported by Helm. https://helm.sh/docs/chart_best_practices/custom_resource_definitions.\"\n                    enum:\n                    - Skip\n                    - Create\n                    - CreateReplace\n                    type: string\n                  disableHooks:\n                    description: DisableHooks prevents hooks from running during the\n                      Helm upgrade action.\n                    type: boolean\n                  disableOpenAPIValidation:\n                    description: DisableOpenAPIValidation prevents the Helm upgrade\n                      action from validating rendered templates against the Kubernetes\n                      OpenAPI Schema.\n                    type: boolean\n                  disableWait:\n                    description: DisableWait disables the waiting for resources to\n                      be ready after a Helm upgrade has been performed.\n                    type: boolean\n                  disableWaitForJobs:\n                    description: DisableWaitForJobs disables waiting for jobs to complete\n                      after a Helm upgrade has been performed.\n                    type: boolean\n                  force:\n                    description: Force forces resource updates through a replacement\n                      strategy.\n                    type: boolean\n                  preserveValues:\n                    description: PreserveValues will make Helm reuse the last release's\n                      values and merge in overrides from 'Values'. Setting this flag\n                      makes the HelmRelease non-declarative.\n                    type: boolean\n                  remediation:\n                    description: Remediation holds the remediation configuration for\n                      when the Helm upgrade action for the HelmRelease fails. The\n                      default is to not perform any action.\n                    properties:\n                      ignoreTestFailures:\n                        description: IgnoreTestFailures tells the controller to skip\n                          remediation when the Helm tests are run after an upgrade\n                          action but fail. Defaults to 'Test.IgnoreFailures'.\n                        type: boolean\n                      remediateLastFailure:\n                        description: RemediateLastFailure tells the controller to\n                          remediate the last failure, when no retries remain. Defaults\n                          to 'false' unless 'Retries' is greater than 0.\n                        type: boolean\n                      retries:\n                        description: Retries is the number of retries that should\n                          be attempted on failures before bailing. Remediation, using\n                          'Strategy', is performed between each attempt. Defaults\n                          to '0', a negative integer equals to unlimited retries.\n                        type: integer\n                      strategy:\n                        description: Strategy to use for failure remediation. Defaults\n                          to 'rollback'.\n                        enum:\n                        - rollback\n                        - uninstall\n                        type: string\n                    type: object\n                  timeout:\n                    description: Timeout is the time to wait for any individual Kubernetes\n                      operation (like Jobs for hooks) during the performance of a\n                      Helm upgrade action. Defaults to 'HelmReleaseSpec.Timeout'.\n                    type: string\n                type: object\n              values:\n                description: Values holds the values for this Helm release.\n                x-kubernetes-preserve-unknown-fields: true\n              valuesFrom:\n                description: ValuesFrom holds references to resources containing Helm\n                  values for this HelmRelease, and information about how they should\n                  be merged.\n                items:\n                  description: ValuesReference contains a reference to a resource\n                    containing Helm values, and optionally the key they can be found\n                    at.\n                  properties:\n                    kind:\n                      description: Kind of the values referent, valid values are ('Secret',\n                        'ConfigMap').\n                      enum:\n                      - Secret\n                      - ConfigMap\n                      type: string\n                    name:\n                      description: Name of the values referent. Should reside in the\n                        same namespace as the referring resource.\n                      maxLength: 253\n                      minLength: 1\n                      type: string\n                    optional:\n                      description: Optional marks this ValuesReference as optional.\n                        When set, a not found error for the values reference is ignored,\n                        but any ValuesKey, TargetPath or transient error will still\n                        result in a reconciliation failure.\n                      type: boolean\n                    targetPath:\n                      description: TargetPath is the YAML dot notation path the value\n                        should be merged at. When set, the ValuesKey is expected to\n                        be a single flat value. Defaults to 'None', which results\n                        in the values getting merged at the root.\n                      type: string\n                    valuesKey:\n                      description: ValuesKey is the data key where the values.yaml\n                        or a specific value can be found at. Defaults to 'values.yaml'.\n                      type: string\n                  required:\n                  - kind\n                  - name\n                  type: object\n                type: array\n            required:\n            - chart\n            - interval\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: HelmReleaseStatus defines the observed state of a HelmRelease.\n            properties:\n              conditions:\n                description: Conditions holds the conditions for the HelmRelease.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              failures:\n                description: Failures is the reconciliation failure count against\n                  the latest desired state. It is reset after a successful reconciliation.\n                format: int64\n                type: integer\n              helmChart:\n                description: HelmChart is the namespaced name of the HelmChart resource\n                  created by the controller for the HelmRelease.\n                type: string\n              installFailures:\n                description: InstallFailures is the install failure count against\n                  the latest desired state. It is reset after a successful reconciliation.\n                format: int64\n                type: integer\n              lastAppliedRevision:\n                description: LastAppliedRevision is the revision of the last successfully\n                  applied source.\n                type: string\n              lastAttemptedRevision:\n                description: LastAttemptedRevision is the revision of the last reconciliation\n                  attempt.\n                type: string\n              lastAttemptedValuesChecksum:\n                description: LastAttemptedValuesChecksum is the SHA1 checksum of the\n                  values of the last reconciliation attempt.\n                type: string\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              lastReleaseRevision:\n                description: LastReleaseRevision is the revision of the last successful\n                  Helm release.\n                type: integer\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation.\n                format: int64\n                type: integer\n              upgradeFailures:\n                description: UpgradeFailures is the upgrade failure count against\n                  the latest desired state. It is reset after a successful reconciliation.\n                format: int64\n                type: integer\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []\n",
+            "yaml_incluster": "d51b7c35b26ed986bcfa84ed08648f99ac676ee90faa8997907a1f02fdf9a93d"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "apiextensions.k8s.io/v1/customresourcedefinition/helmrepositories.source.toolkit.fluxcd.io",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "apiextensions.k8s.io/v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions/helmrepositories.source.toolkit.fluxcd.io",
+            "ignore_fields": null,
+            "kind": "CustomResourceDefinition",
+            "live_manifest_incluster": "6c2509f56e57891949c7bae5eceb2744c992cd14ec3f53aba64e28d0b0a683f4",
+            "live_uid": "519ecd1b-df1b-4395-8827-2bb94900c071",
+            "name": "helmrepositories.source.toolkit.fluxcd.io",
+            "namespace": null,
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "519ecd1b-df1b-4395-8827-2bb94900c071",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: helmrepositories.source.toolkit.fluxcd.io\nspec:\n  group: source.toolkit.fluxcd.io\n  names:\n    kind: HelmRepository\n    listKind: HelmRepositoryList\n    plural: helmrepositories\n    shortNames:\n    - helmrepo\n    singular: helmrepository\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .spec.url\n      name: URL\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    name: v1beta1\n    schema:\n      openAPIV3Schema:\n        description: HelmRepository is the Schema for the helmrepositories API\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: HelmRepositorySpec defines the reference to a Helm repository.\n            properties:\n              accessFrom:\n                description: AccessFrom defines an Access Control List for allowing\n                  cross-namespace references to this object.\n                properties:\n                  namespaceSelectors:\n                    description: NamespaceSelectors is the list of namespace selectors\n                      to which this ACL applies. Items in this list are evaluated\n                      using a logical OR operation.\n                    items:\n                      description: NamespaceSelector selects the namespaces to which\n                        this ACL applies. An empty map of MatchLabels matches all\n                        namespaces in a cluster.\n                      properties:\n                        matchLabels:\n                          additionalProperties:\n                            type: string\n                          description: MatchLabels is a map of {key,value} pairs.\n                            A single {key,value} in the matchLabels map is equivalent\n                            to an element of matchExpressions, whose key field is\n                            \"key\", the operator is \"In\", and the values array contains\n                            only \"value\". The requirements are ANDed.\n                          type: object\n                      type: object\n                    type: array\n                required:\n                - namespaceSelectors\n                type: object\n              interval:\n                description: The interval at which to check the upstream for updates.\n                type: string\n              passCredentials:\n                description: PassCredentials allows the credentials from the SecretRef\n                  to be passed on to a host that does not match the host as defined\n                  in URL. This may be required if the host of the advertised chart\n                  URLs in the index differ from the defined URL. Enabling this should\n                  be done with caution, as it can potentially result in credentials\n                  getting stolen in a MITM-attack.\n                type: boolean\n              secretRef:\n                description: The name of the secret containing authentication credentials\n                  for the Helm repository. For HTTP/S basic auth the secret must contain\n                  username and password fields. For TLS the secret must contain a\n                  certFile and keyFile, and/or caCert fields.\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              suspend:\n                description: This flag tells the controller to suspend the reconciliation\n                  of this source.\n                type: boolean\n              timeout:\n                default: 60s\n                description: The timeout of index downloading, defaults to 60s.\n                type: string\n              url:\n                description: The Helm repository URL, a valid URL contains at least\n                  a protocol and host.\n                type: string\n            required:\n            - interval\n            - url\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: HelmRepositoryStatus defines the observed state of the HelmRepository.\n            properties:\n              artifact:\n                description: Artifact represents the output of the last successful\n                  repository sync.\n                properties:\n                  checksum:\n                    description: Checksum is the SHA256 checksum of the artifact.\n                    type: string\n                  lastUpdateTime:\n                    description: LastUpdateTime is the timestamp corresponding to\n                      the last update of this artifact.\n                    format: date-time\n                    type: string\n                  path:\n                    description: Path is the relative file path of this artifact.\n                    type: string\n                  revision:\n                    description: Revision is a human readable identifier traceable\n                      in the origin source system. It can be a Git commit SHA, Git\n                      tag, a Helm index timestamp, a Helm chart version, etc.\n                    type: string\n                  url:\n                    description: URL is the HTTP address of this artifact.\n                    type: string\n                required:\n                - path\n                - url\n                type: object\n              conditions:\n                description: Conditions holds the conditions for the HelmRepository.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation.\n                format: int64\n                type: integer\n              url:\n                description: URL is the download link for the last index fetched.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: false\n    subresources:\n      status: {}\n  - additionalPrinterColumns:\n    - jsonPath: .spec.url\n      name: URL\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v1beta2\n    schema:\n      openAPIV3Schema:\n        description: HelmRepository is the Schema for the helmrepositories API.\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: HelmRepositorySpec specifies the required configuration to\n              produce an Artifact for a Helm repository index YAML.\n            properties:\n              accessFrom:\n                description: 'AccessFrom specifies an Access Control List for allowing\n                  cross-namespace references to this object. NOTE: Not implemented,\n                  provisional as of https://github.com/fluxcd/flux2/pull/2092'\n                properties:\n                  namespaceSelectors:\n                    description: NamespaceSelectors is the list of namespace selectors\n                      to which this ACL applies. Items in this list are evaluated\n                      using a logical OR operation.\n                    items:\n                      description: NamespaceSelector selects the namespaces to which\n                        this ACL applies. An empty map of MatchLabels matches all\n                        namespaces in a cluster.\n                      properties:\n                        matchLabels:\n                          additionalProperties:\n                            type: string\n                          description: MatchLabels is a map of {key,value} pairs.\n                            A single {key,value} in the matchLabels map is equivalent\n                            to an element of matchExpressions, whose key field is\n                            \"key\", the operator is \"In\", and the values array contains\n                            only \"value\". The requirements are ANDed.\n                          type: object\n                      type: object\n                    type: array\n                required:\n                - namespaceSelectors\n                type: object\n              interval:\n                description: Interval at which to check the URL for updates.\n                type: string\n              passCredentials:\n                description: PassCredentials allows the credentials from the SecretRef\n                  to be passed on to a host that does not match the host as defined\n                  in URL. This may be required if the host of the advertised chart\n                  URLs in the index differ from the defined URL. Enabling this should\n                  be done with caution, as it can potentially result in credentials\n                  getting stolen in a MITM-attack.\n                type: boolean\n              secretRef:\n                description: SecretRef specifies the Secret containing authentication\n                  credentials for the HelmRepository. For HTTP/S basic auth the secret\n                  must contain 'username' and 'password' fields. For TLS the secret\n                  must contain a 'certFile' and 'keyFile', and/or 'caCert' fields.\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              suspend:\n                description: Suspend tells the controller to suspend the reconciliation\n                  of this HelmRepository.\n                type: boolean\n              timeout:\n                default: 60s\n                description: Timeout of the index fetch operation, defaults to 60s.\n                type: string\n              url:\n                description: URL of the Helm repository, a valid URL contains at least\n                  a protocol and host.\n                type: string\n            required:\n            - interval\n            - url\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: HelmRepositoryStatus records the observed state of the HelmRepository.\n            properties:\n              artifact:\n                description: Artifact represents the last successful HelmRepository\n                  reconciliation.\n                properties:\n                  checksum:\n                    description: Checksum is the SHA256 checksum of the Artifact file.\n                    type: string\n                  lastUpdateTime:\n                    description: LastUpdateTime is the timestamp corresponding to\n                      the last update of the Artifact.\n                    format: date-time\n                    type: string\n                  path:\n                    description: Path is the relative file path of the Artifact. It\n                      can be used to locate the file in the root of the Artifact storage\n                      on the local file system of the controller managing the Source.\n                    type: string\n                  revision:\n                    description: Revision is a human-readable identifier traceable\n                      in the origin source system. It can be a Git commit SHA, Git\n                      tag, a Helm chart version, etc.\n                    type: string\n                  size:\n                    description: Size is the number of bytes in the file.\n                    format: int64\n                    type: integer\n                  url:\n                    description: URL is the HTTP address of the Artifact as exposed\n                      by the controller managing the Source. It can be used to retrieve\n                      the Artifact for consumption, e.g. by another controller applying\n                      the Artifact contents.\n                    type: string\n                required:\n                - path\n                - url\n                type: object\n              conditions:\n                description: Conditions holds the conditions for the HelmRepository.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation of\n                  the HelmRepository object.\n                format: int64\n                type: integer\n              url:\n                description: URL is the dynamic fetch link for the latest Artifact.\n                  It is provided on a \"best effort\" basis, and using the precise HelmRepositoryStatus.Artifact\n                  data is recommended.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []",
+            "yaml_body_parsed": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: helmrepositories.source.toolkit.fluxcd.io\nspec:\n  group: source.toolkit.fluxcd.io\n  names:\n    kind: HelmRepository\n    listKind: HelmRepositoryList\n    plural: helmrepositories\n    shortNames:\n    - helmrepo\n    singular: helmrepository\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .spec.url\n      name: URL\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    name: v1beta1\n    schema:\n      openAPIV3Schema:\n        description: HelmRepository is the Schema for the helmrepositories API\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: HelmRepositorySpec defines the reference to a Helm repository.\n            properties:\n              accessFrom:\n                description: AccessFrom defines an Access Control List for allowing\n                  cross-namespace references to this object.\n                properties:\n                  namespaceSelectors:\n                    description: NamespaceSelectors is the list of namespace selectors\n                      to which this ACL applies. Items in this list are evaluated\n                      using a logical OR operation.\n                    items:\n                      description: NamespaceSelector selects the namespaces to which\n                        this ACL applies. An empty map of MatchLabels matches all\n                        namespaces in a cluster.\n                      properties:\n                        matchLabels:\n                          additionalProperties:\n                            type: string\n                          description: MatchLabels is a map of {key,value} pairs.\n                            A single {key,value} in the matchLabels map is equivalent\n                            to an element of matchExpressions, whose key field is\n                            \"key\", the operator is \"In\", and the values array contains\n                            only \"value\". The requirements are ANDed.\n                          type: object\n                      type: object\n                    type: array\n                required:\n                - namespaceSelectors\n                type: object\n              interval:\n                description: The interval at which to check the upstream for updates.\n                type: string\n              passCredentials:\n                description: PassCredentials allows the credentials from the SecretRef\n                  to be passed on to a host that does not match the host as defined\n                  in URL. This may be required if the host of the advertised chart\n                  URLs in the index differ from the defined URL. Enabling this should\n                  be done with caution, as it can potentially result in credentials\n                  getting stolen in a MITM-attack.\n                type: boolean\n              secretRef:\n                description: The name of the secret containing authentication credentials\n                  for the Helm repository. For HTTP/S basic auth the secret must contain\n                  username and password fields. For TLS the secret must contain a\n                  certFile and keyFile, and/or caCert fields.\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              suspend:\n                description: This flag tells the controller to suspend the reconciliation\n                  of this source.\n                type: boolean\n              timeout:\n                default: 60s\n                description: The timeout of index downloading, defaults to 60s.\n                type: string\n              url:\n                description: The Helm repository URL, a valid URL contains at least\n                  a protocol and host.\n                type: string\n            required:\n            - interval\n            - url\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: HelmRepositoryStatus defines the observed state of the HelmRepository.\n            properties:\n              artifact:\n                description: Artifact represents the output of the last successful\n                  repository sync.\n                properties:\n                  checksum:\n                    description: Checksum is the SHA256 checksum of the artifact.\n                    type: string\n                  lastUpdateTime:\n                    description: LastUpdateTime is the timestamp corresponding to\n                      the last update of this artifact.\n                    format: date-time\n                    type: string\n                  path:\n                    description: Path is the relative file path of this artifact.\n                    type: string\n                  revision:\n                    description: Revision is a human readable identifier traceable\n                      in the origin source system. It can be a Git commit SHA, Git\n                      tag, a Helm index timestamp, a Helm chart version, etc.\n                    type: string\n                  url:\n                    description: URL is the HTTP address of this artifact.\n                    type: string\n                required:\n                - path\n                - url\n                type: object\n              conditions:\n                description: Conditions holds the conditions for the HelmRepository.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation.\n                format: int64\n                type: integer\n              url:\n                description: URL is the download link for the last index fetched.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: false\n    subresources:\n      status: {}\n  - additionalPrinterColumns:\n    - jsonPath: .spec.url\n      name: URL\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v1beta2\n    schema:\n      openAPIV3Schema:\n        description: HelmRepository is the Schema for the helmrepositories API.\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: HelmRepositorySpec specifies the required configuration to\n              produce an Artifact for a Helm repository index YAML.\n            properties:\n              accessFrom:\n                description: 'AccessFrom specifies an Access Control List for allowing\n                  cross-namespace references to this object. NOTE: Not implemented,\n                  provisional as of https://github.com/fluxcd/flux2/pull/2092'\n                properties:\n                  namespaceSelectors:\n                    description: NamespaceSelectors is the list of namespace selectors\n                      to which this ACL applies. Items in this list are evaluated\n                      using a logical OR operation.\n                    items:\n                      description: NamespaceSelector selects the namespaces to which\n                        this ACL applies. An empty map of MatchLabels matches all\n                        namespaces in a cluster.\n                      properties:\n                        matchLabels:\n                          additionalProperties:\n                            type: string\n                          description: MatchLabels is a map of {key,value} pairs.\n                            A single {key,value} in the matchLabels map is equivalent\n                            to an element of matchExpressions, whose key field is\n                            \"key\", the operator is \"In\", and the values array contains\n                            only \"value\". The requirements are ANDed.\n                          type: object\n                      type: object\n                    type: array\n                required:\n                - namespaceSelectors\n                type: object\n              interval:\n                description: Interval at which to check the URL for updates.\n                type: string\n              passCredentials:\n                description: PassCredentials allows the credentials from the SecretRef\n                  to be passed on to a host that does not match the host as defined\n                  in URL. This may be required if the host of the advertised chart\n                  URLs in the index differ from the defined URL. Enabling this should\n                  be done with caution, as it can potentially result in credentials\n                  getting stolen in a MITM-attack.\n                type: boolean\n              secretRef:\n                description: SecretRef specifies the Secret containing authentication\n                  credentials for the HelmRepository. For HTTP/S basic auth the secret\n                  must contain 'username' and 'password' fields. For TLS the secret\n                  must contain a 'certFile' and 'keyFile', and/or 'caCert' fields.\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              suspend:\n                description: Suspend tells the controller to suspend the reconciliation\n                  of this HelmRepository.\n                type: boolean\n              timeout:\n                default: 60s\n                description: Timeout of the index fetch operation, defaults to 60s.\n                type: string\n              url:\n                description: URL of the Helm repository, a valid URL contains at least\n                  a protocol and host.\n                type: string\n            required:\n            - interval\n            - url\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: HelmRepositoryStatus records the observed state of the HelmRepository.\n            properties:\n              artifact:\n                description: Artifact represents the last successful HelmRepository\n                  reconciliation.\n                properties:\n                  checksum:\n                    description: Checksum is the SHA256 checksum of the Artifact file.\n                    type: string\n                  lastUpdateTime:\n                    description: LastUpdateTime is the timestamp corresponding to\n                      the last update of the Artifact.\n                    format: date-time\n                    type: string\n                  path:\n                    description: Path is the relative file path of the Artifact. It\n                      can be used to locate the file in the root of the Artifact storage\n                      on the local file system of the controller managing the Source.\n                    type: string\n                  revision:\n                    description: Revision is a human-readable identifier traceable\n                      in the origin source system. It can be a Git commit SHA, Git\n                      tag, a Helm chart version, etc.\n                    type: string\n                  size:\n                    description: Size is the number of bytes in the file.\n                    format: int64\n                    type: integer\n                  url:\n                    description: URL is the HTTP address of the Artifact as exposed\n                      by the controller managing the Source. It can be used to retrieve\n                      the Artifact for consumption, e.g. by another controller applying\n                      the Artifact contents.\n                    type: string\n                required:\n                - path\n                - url\n                type: object\n              conditions:\n                description: Conditions holds the conditions for the HelmRepository.\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation of\n                  the HelmRepository object.\n                format: int64\n                type: integer\n              url:\n                description: URL is the dynamic fetch link for the latest Artifact.\n                  It is provided on a \"best effort\" basis, and using the precise HelmRepositoryStatus.Artifact\n                  data is recommended.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []\n",
+            "yaml_incluster": "6c2509f56e57891949c7bae5eceb2744c992cd14ec3f53aba64e28d0b0a683f4"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "apiextensions.k8s.io/v1/customresourcedefinition/kustomizations.kustomize.toolkit.fluxcd.io",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "apiextensions.k8s.io/v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions/kustomizations.kustomize.toolkit.fluxcd.io",
+            "ignore_fields": null,
+            "kind": "CustomResourceDefinition",
+            "live_manifest_incluster": "fd7e8602f5c8f9c751fc481764ee8c7fbe00c1e39e611464521002e45fb44580",
+            "live_uid": "09c02430-bd93-4995-8816-220b03cd8a43",
+            "name": "kustomizations.kustomize.toolkit.fluxcd.io",
+            "namespace": null,
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "09c02430-bd93-4995-8816-220b03cd8a43",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: kustomizations.kustomize.toolkit.fluxcd.io\nspec:\n  group: kustomize.toolkit.fluxcd.io\n  names:\n    kind: Kustomization\n    listKind: KustomizationList\n    plural: kustomizations\n    shortNames:\n    - ks\n    singular: kustomization\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    name: v1beta1\n    schema:\n      openAPIV3Schema:\n        description: Kustomization is the Schema for the kustomizations API.\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: KustomizationSpec defines the desired state of a kustomization.\n            properties:\n              decryption:\n                description: Decrypt Kubernetes secrets before applying them on the\n                  cluster.\n                properties:\n                  provider:\n                    description: Provider is the name of the decryption engine.\n                    enum:\n                    - sops\n                    type: string\n                  secretRef:\n                    description: The secret name containing the private OpenPGP keys\n                      used for decryption.\n                    properties:\n                      name:\n                        description: Name of the referent.\n                        type: string\n                    required:\n                    - name\n                    type: object\n                required:\n                - provider\n                type: object\n              dependsOn:\n                description: DependsOn may contain a meta.NamespacedObjectReference\n                  slice with references to Kustomization resources that must be ready\n                  before this Kustomization can be reconciled.\n                items:\n                  description: NamespacedObjectReference contains enough information\n                    to locate the referenced Kubernetes resource object in any namespace.\n                  properties:\n                    name:\n                      description: Name of the referent.\n                      type: string\n                    namespace:\n                      description: Namespace of the referent, when not specified it\n                        acts as LocalObjectReference.\n                      type: string\n                  required:\n                  - name\n                  type: object\n                type: array\n              force:\n                default: false\n                description: Force instructs the controller to recreate resources\n                  when patching fails due to an immutable field change.\n                type: boolean\n              healthChecks:\n                description: A list of resources to be included in the health assessment.\n                items:\n                  description: NamespacedObjectKindReference contains enough information\n                    to locate the typed referenced Kubernetes resource object in any\n                    namespace.\n                  properties:\n                    apiVersion:\n                      description: API version of the referent, if not specified the\n                        Kubernetes preferred version will be used.\n                      type: string\n                    kind:\n                      description: Kind of the referent.\n                      type: string\n                    name:\n                      description: Name of the referent.\n                      type: string\n                    namespace:\n                      description: Namespace of the referent, when not specified it\n                        acts as LocalObjectReference.\n                      type: string\n                  required:\n                  - kind\n                  - name\n                  type: object\n                type: array\n              images:\n                description: Images is a list of (image name, new name, new tag or\n                  digest) for changing image names, tags or digests. This can also\n                  be achieved with a patch, but this operator is simpler to specify.\n                items:\n                  description: Image contains an image name, a new name, a new tag\n                    or digest, which will replace the original name and tag.\n                  properties:\n                    digest:\n                      description: Digest is the value used to replace the original\n                        image tag. If digest is present NewTag value is ignored.\n                      type: string\n                    name:\n                      description: Name is a tag-less image name.\n                      type: string\n                    newName:\n                      description: NewName is the value used to replace the original\n                        name.\n                      type: string\n                    newTag:\n                      description: NewTag is the value used to replace the original\n                        tag.\n                      type: string\n                  required:\n                  - name\n                  type: object\n                type: array\n              interval:\n                description: The interval at which to reconcile the Kustomization.\n                type: string\n              kubeConfig:\n                description: The KubeConfig for reconciling the Kustomization on a\n                  remote cluster. When specified, KubeConfig takes precedence over\n                  ServiceAccountName.\n                properties:\n                  secretRef:\n                    description: SecretRef holds the name to a secret that contains\n                      a 'value' key with the kubeconfig file as the value. It must\n                      be in the same namespace as the Kustomization. It is recommended\n                      that the kubeconfig is self-contained, and the secret is regularly\n                      updated if credentials such as a cloud-access-token expire.\n                      Cloud specific `cmd-path` auth helpers will not function without\n                      adding binaries and credentials to the Pod that is responsible\n                      for reconciling the Kustomization.\n                    properties:\n                      name:\n                        description: Name of the referent.\n                        type: string\n                    required:\n                    - name\n                    type: object\n                type: object\n              patches:\n                description: Strategic merge and JSON patches, defined as inline YAML\n                  objects, capable of targeting objects based on kind, label and annotation\n                  selectors.\n                items:\n                  description: Patch contains an inline StrategicMerge or JSON6902\n                    patch, and the target the patch should be applied to.\n                  properties:\n                    patch:\n                      description: Patch contains an inline StrategicMerge patch or\n                        an inline JSON6902 patch with an array of operation objects.\n                      type: string\n                    target:\n                      description: Target points to the resources that the patch document\n                        should be applied to.\n                      properties:\n                        annotationSelector:\n                          description: AnnotationSelector is a string that follows\n                            the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                            It matches with the resource annotations.\n                          type: string\n                        group:\n                          description: Group is the API group to select resources\n                            from. Together with Version and Kind it is capable of\n                            unambiguously identifying and/or selecting resources.\n                            https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                        kind:\n                          description: Kind of the API Group to select resources from.\n                            Together with Group and Version it is capable of unambiguously\n                            identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                        labelSelector:\n                          description: LabelSelector is a string that follows the\n                            label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                            It matches with the resource labels.\n                          type: string\n                        name:\n                          description: Name to match resources with.\n                          type: string\n                        namespace:\n                          description: Namespace to select resources from.\n                          type: string\n                        version:\n                          description: Version of the API Group to select resources\n                            from. Together with Group and Kind it is capable of unambiguously\n                            identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                      type: object\n                  type: object\n                type: array\n              patchesJson6902:\n                description: JSON 6902 patches, defined as inline YAML objects.\n                items:\n                  description: JSON6902Patch contains a JSON6902 patch and the target\n                    the patch should be applied to.\n                  properties:\n                    patch:\n                      description: Patch contains the JSON6902 patch document with\n                        an array of operation objects.\n                      items:\n                        description: JSON6902 is a JSON6902 operation object. https://datatracker.ietf.org/doc/html/rfc6902#section-4\n                        properties:\n                          from:\n                            description: From contains a JSON-pointer value that references\n                              a location within the target document where the operation\n                              is performed. The meaning of the value depends on the\n                              value of Op, and is NOT taken into account by all operations.\n                            type: string\n                          op:\n                            description: Op indicates the operation to perform. Its\n                              value MUST be one of \"add\", \"remove\", \"replace\", \"move\",\n                              \"copy\", or \"test\". https://datatracker.ietf.org/doc/html/rfc6902#section-4\n                            enum:\n                            - test\n                            - remove\n                            - add\n                            - replace\n                            - move\n                            - copy\n                            type: string\n                          path:\n                            description: Path contains the JSON-pointer value that\n                              references a location within the target document where\n                              the operation is performed. The meaning of the value\n                              depends on the value of Op.\n                            type: string\n                          value:\n                            description: Value contains a valid JSON structure. The\n                              meaning of the value depends on the value of Op, and\n                              is NOT taken into account by all operations.\n                            x-kubernetes-preserve-unknown-fields: true\n                        required:\n                        - op\n                        - path\n                        type: object\n                      type: array\n                    target:\n                      description: Target points to the resources that the patch document\n                        should be applied to.\n                      properties:\n                        annotationSelector:\n                          description: AnnotationSelector is a string that follows\n                            the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                            It matches with the resource annotations.\n                          type: string\n                        group:\n                          description: Group is the API group to select resources\n                            from. Together with Version and Kind it is capable of\n                            unambiguously identifying and/or selecting resources.\n                            https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                        kind:\n                          description: Kind of the API Group to select resources from.\n                            Together with Group and Version it is capable of unambiguously\n                            identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                        labelSelector:\n                          description: LabelSelector is a string that follows the\n                            label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                            It matches with the resource labels.\n                          type: string\n                        name:\n                          description: Name to match resources with.\n                          type: string\n                        namespace:\n                          description: Namespace to select resources from.\n                          type: string\n                        version:\n                          description: Version of the API Group to select resources\n                            from. Together with Group and Kind it is capable of unambiguously\n                            identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                      type: object\n                  required:\n                  - patch\n                  - target\n                  type: object\n                type: array\n              patchesStrategicMerge:\n                description: Strategic merge patches, defined as inline YAML objects.\n                items:\n                  x-kubernetes-preserve-unknown-fields: true\n                type: array\n              path:\n                description: Path to the directory containing the kustomization.yaml\n                  file, or the set of plain YAMLs a kustomization.yaml should be generated\n                  for. Defaults to 'None', which translates to the root path of the\n                  SourceRef.\n                type: string\n              postBuild:\n                description: PostBuild describes which actions to perform on the YAML\n                  manifest generated by building the kustomize overlay.\n                properties:\n                  substitute:\n                    additionalProperties:\n                      type: string\n                    description: Substitute holds a map of key/value pairs. The variables\n                      defined in your YAML manifests that match any of the keys defined\n                      in the map will be substituted with the set value. Includes\n                      support for bash string replacement functions e.g. ${var:=default},\n                      ${var:position} and ${var/substring/replacement}.\n                    type: object\n                  substituteFrom:\n                    description: SubstituteFrom holds references to ConfigMaps and\n                      Secrets containing the variables and their values to be substituted\n                      in the YAML manifests. The ConfigMap and the Secret data keys\n                      represent the var names and they must match the vars declared\n                      in the manifests for the substitution to happen.\n                    items:\n                      description: SubstituteReference contains a reference to a resource\n                        containing the variables name and value.\n                      properties:\n                        kind:\n                          description: Kind of the values referent, valid values are\n                            ('Secret', 'ConfigMap').\n                          enum:\n                          - Secret\n                          - ConfigMap\n                          type: string\n                        name:\n                          description: Name of the values referent. Should reside\n                            in the same namespace as the referring resource.\n                          maxLength: 253\n                          minLength: 1\n                          type: string\n                      required:\n                      - kind\n                      - name\n                      type: object\n                    type: array\n                type: object\n              prune:\n                description: Prune enables garbage collection.\n                type: boolean\n              retryInterval:\n                description: The interval at which to retry a previously failed reconciliation.\n                  When not specified, the controller uses the KustomizationSpec.Interval\n                  value to retry failures.\n                type: string\n              serviceAccountName:\n                description: The name of the Kubernetes service account to impersonate\n                  when reconciling this Kustomization.\n                type: string\n              sourceRef:\n                description: Reference of the source where the kustomization file\n                  is.\n                properties:\n                  apiVersion:\n                    description: API version of the referent\n                    type: string\n                  kind:\n                    description: Kind of the referent\n                    enum:\n                    - GitRepository\n                    - Bucket\n                    type: string\n                  name:\n                    description: Name of the referent\n                    type: string\n                  namespace:\n                    description: Namespace of the referent, defaults to the Kustomization\n                      namespace\n                    type: string\n                required:\n                - kind\n                - name\n                type: object\n              suspend:\n                description: This flag tells the controller to suspend subsequent\n                  kustomize executions, it does not apply to already started executions.\n                  Defaults to false.\n                type: boolean\n              targetNamespace:\n                description: TargetNamespace sets or overrides the namespace in the\n                  kustomization.yaml file.\n                maxLength: 63\n                minLength: 1\n                type: string\n              timeout:\n                description: Timeout for validation, apply and health checking operations.\n                  Defaults to 'Interval' duration.\n                type: string\n              validation:\n                description: Validate the Kubernetes objects before applying them\n                  on the cluster. The validation strategy can be 'client' (local dry-run),\n                  'server' (APIServer dry-run) or 'none'. When 'Force' is 'true',\n                  validation will fallback to 'client' if set to 'server' because\n                  server-side validation is not supported in this scenario.\n                enum:\n                - none\n                - client\n                - server\n                type: string\n            required:\n            - interval\n            - prune\n            - sourceRef\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: KustomizationStatus defines the observed state of a kustomization.\n            properties:\n              conditions:\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              lastAppliedRevision:\n                description: The last successfully applied revision. The revision\n                  format for Git sources is \u003cbranch|tag\u003e/\u003ccommit-sha\u003e.\n                type: string\n              lastAttemptedRevision:\n                description: LastAttemptedRevision is the revision of the last reconciliation\n                  attempt.\n                type: string\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last reconciled generation.\n                format: int64\n                type: integer\n              snapshot:\n                description: The last successfully applied revision metadata.\n                properties:\n                  checksum:\n                    description: The manifests sha1 checksum.\n                    type: string\n                  entries:\n                    description: A list of Kubernetes kinds grouped by namespace.\n                    items:\n                      description: Snapshot holds the metadata of namespaced Kubernetes\n                        objects\n                      properties:\n                        kinds:\n                          additionalProperties:\n                            type: string\n                          description: The list of Kubernetes kinds.\n                          type: object\n                        namespace:\n                          description: The namespace of this entry.\n                          type: string\n                      required:\n                      - kinds\n                      type: object\n                    type: array\n                required:\n                - checksum\n                - entries\n                type: object\n            type: object\n        type: object\n    served: true\n    storage: false\n    subresources:\n      status: {}\n  - additionalPrinterColumns:\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v1beta2\n    schema:\n      openAPIV3Schema:\n        description: Kustomization is the Schema for the kustomizations API.\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: KustomizationSpec defines the configuration to calculate\n              the desired state from a Source using Kustomize.\n            properties:\n              decryption:\n                description: Decrypt Kubernetes secrets before applying them on the\n                  cluster.\n                properties:\n                  provider:\n                    description: Provider is the name of the decryption engine.\n                    enum:\n                    - sops\n                    type: string\n                  secretRef:\n                    description: The secret name containing the private OpenPGP keys\n                      used for decryption.\n                    properties:\n                      name:\n                        description: Name of the referent.\n                        type: string\n                    required:\n                    - name\n                    type: object\n                required:\n                - provider\n                type: object\n              dependsOn:\n                description: DependsOn may contain a meta.NamespacedObjectReference\n                  slice with references to Kustomization resources that must be ready\n                  before this Kustomization can be reconciled.\n                items:\n                  description: NamespacedObjectReference contains enough information\n                    to locate the referenced Kubernetes resource object in any namespace.\n                  properties:\n                    name:\n                      description: Name of the referent.\n                      type: string\n                    namespace:\n                      description: Namespace of the referent, when not specified it\n                        acts as LocalObjectReference.\n                      type: string\n                  required:\n                  - name\n                  type: object\n                type: array\n              force:\n                default: false\n                description: Force instructs the controller to recreate resources\n                  when patching fails due to an immutable field change.\n                type: boolean\n              healthChecks:\n                description: A list of resources to be included in the health assessment.\n                items:\n                  description: NamespacedObjectKindReference contains enough information\n                    to locate the typed referenced Kubernetes resource object in any\n                    namespace.\n                  properties:\n                    apiVersion:\n                      description: API version of the referent, if not specified the\n                        Kubernetes preferred version will be used.\n                      type: string\n                    kind:\n                      description: Kind of the referent.\n                      type: string\n                    name:\n                      description: Name of the referent.\n                      type: string\n                    namespace:\n                      description: Namespace of the referent, when not specified it\n                        acts as LocalObjectReference.\n                      type: string\n                  required:\n                  - kind\n                  - name\n                  type: object\n                type: array\n              images:\n                description: Images is a list of (image name, new name, new tag or\n                  digest) for changing image names, tags or digests. This can also\n                  be achieved with a patch, but this operator is simpler to specify.\n                items:\n                  description: Image contains an image name, a new name, a new tag\n                    or digest, which will replace the original name and tag.\n                  properties:\n                    digest:\n                      description: Digest is the value used to replace the original\n                        image tag. If digest is present NewTag value is ignored.\n                      type: string\n                    name:\n                      description: Name is a tag-less image name.\n                      type: string\n                    newName:\n                      description: NewName is the value used to replace the original\n                        name.\n                      type: string\n                    newTag:\n                      description: NewTag is the value used to replace the original\n                        tag.\n                      type: string\n                  required:\n                  - name\n                  type: object\n                type: array\n              interval:\n                description: The interval at which to reconcile the Kustomization.\n                type: string\n              kubeConfig:\n                description: The KubeConfig for reconciling the Kustomization on a\n                  remote cluster. When used in combination with KustomizationSpec.ServiceAccountName,\n                  forces the controller to act on behalf of that Service Account at\n                  the target cluster. If the --default-service-account flag is set,\n                  its value will be used as a controller level fallback for when KustomizationSpec.ServiceAccountName\n                  is empty.\n                properties:\n                  secretRef:\n                    description: SecretRef holds the name of a secret that contains\n                      a key with the kubeconfig file as the value. If no key is set,\n                      the key will default to 'value'. The secret must be in the same\n                      namespace as the Kustomization. It is recommended that the kubeconfig\n                      is self-contained, and the secret is regularly updated if credentials\n                      such as a cloud-access-token expire. Cloud specific `cmd-path`\n                      auth helpers will not function without adding binaries and credentials\n                      to the Pod that is responsible for reconciling the Kustomization.\n                    properties:\n                      key:\n                        description: Key in the Secret, when not specified an implementation-specific\n                          default key is used.\n                        type: string\n                      name:\n                        description: Name of the Secret.\n                        type: string\n                    required:\n                    - name\n                    type: object\n                type: object\n              patches:\n                description: Strategic merge and JSON patches, defined as inline YAML\n                  objects, capable of targeting objects based on kind, label and annotation\n                  selectors.\n                items:\n                  description: Patch contains an inline StrategicMerge or JSON6902\n                    patch, and the target the patch should be applied to.\n                  properties:\n                    patch:\n                      description: Patch contains an inline StrategicMerge patch or\n                        an inline JSON6902 patch with an array of operation objects.\n                      type: string\n                    target:\n                      description: Target points to the resources that the patch document\n                        should be applied to.\n                      properties:\n                        annotationSelector:\n                          description: AnnotationSelector is a string that follows\n                            the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                            It matches with the resource annotations.\n                          type: string\n                        group:\n                          description: Group is the API group to select resources\n                            from. Together with Version and Kind it is capable of\n                            unambiguously identifying and/or selecting resources.\n                            https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                        kind:\n                          description: Kind of the API Group to select resources from.\n                            Together with Group and Version it is capable of unambiguously\n                            identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                        labelSelector:\n                          description: LabelSelector is a string that follows the\n                            label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                            It matches with the resource labels.\n                          type: string\n                        name:\n                          description: Name to match resources with.\n                          type: string\n                        namespace:\n                          description: Namespace to select resources from.\n                          type: string\n                        version:\n                          description: Version of the API Group to select resources\n                            from. Together with Group and Kind it is capable of unambiguously\n                            identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                      type: object\n                  type: object\n                type: array\n              patchesJson6902:\n                description: 'JSON 6902 patches, defined as inline YAML objects. Deprecated:\n                  Use Patches instead.'\n                items:\n                  description: JSON6902Patch contains a JSON6902 patch and the target\n                    the patch should be applied to.\n                  properties:\n                    patch:\n                      description: Patch contains the JSON6902 patch document with\n                        an array of operation objects.\n                      items:\n                        description: JSON6902 is a JSON6902 operation object. https://datatracker.ietf.org/doc/html/rfc6902#section-4\n                        properties:\n                          from:\n                            description: From contains a JSON-pointer value that references\n                              a location within the target document where the operation\n                              is performed. The meaning of the value depends on the\n                              value of Op, and is NOT taken into account by all operations.\n                            type: string\n                          op:\n                            description: Op indicates the operation to perform. Its\n                              value MUST be one of \"add\", \"remove\", \"replace\", \"move\",\n                              \"copy\", or \"test\". https://datatracker.ietf.org/doc/html/rfc6902#section-4\n                            enum:\n                            - test\n                            - remove\n                            - add\n                            - replace\n                            - move\n                            - copy\n                            type: string\n                          path:\n                            description: Path contains the JSON-pointer value that\n                              references a location within the target document where\n                              the operation is performed. The meaning of the value\n                              depends on the value of Op.\n                            type: string\n                          value:\n                            description: Value contains a valid JSON structure. The\n                              meaning of the value depends on the value of Op, and\n                              is NOT taken into account by all operations.\n                            x-kubernetes-preserve-unknown-fields: true\n                        required:\n                        - op\n                        - path\n                        type: object\n                      type: array\n                    target:\n                      description: Target points to the resources that the patch document\n                        should be applied to.\n                      properties:\n                        annotationSelector:\n                          description: AnnotationSelector is a string that follows\n                            the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                            It matches with the resource annotations.\n                          type: string\n                        group:\n                          description: Group is the API group to select resources\n                            from. Together with Version and Kind it is capable of\n                            unambiguously identifying and/or selecting resources.\n                            https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                        kind:\n                          description: Kind of the API Group to select resources from.\n                            Together with Group and Version it is capable of unambiguously\n                            identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                        labelSelector:\n                          description: LabelSelector is a string that follows the\n                            label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                            It matches with the resource labels.\n                          type: string\n                        name:\n                          description: Name to match resources with.\n                          type: string\n                        namespace:\n                          description: Namespace to select resources from.\n                          type: string\n                        version:\n                          description: Version of the API Group to select resources\n                            from. Together with Group and Kind it is capable of unambiguously\n                            identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                      type: object\n                  required:\n                  - patch\n                  - target\n                  type: object\n                type: array\n              patchesStrategicMerge:\n                description: 'Strategic merge patches, defined as inline YAML objects.\n                  Deprecated: Use Patches instead.'\n                items:\n                  x-kubernetes-preserve-unknown-fields: true\n                type: array\n              path:\n                description: Path to the directory containing the kustomization.yaml\n                  file, or the set of plain YAMLs a kustomization.yaml should be generated\n                  for. Defaults to 'None', which translates to the root path of the\n                  SourceRef.\n                type: string\n              postBuild:\n                description: PostBuild describes which actions to perform on the YAML\n                  manifest generated by building the kustomize overlay.\n                properties:\n                  substitute:\n                    additionalProperties:\n                      type: string\n                    description: Substitute holds a map of key/value pairs. The variables\n                      defined in your YAML manifests that match any of the keys defined\n                      in the map will be substituted with the set value. Includes\n                      support for bash string replacement functions e.g. ${var:=default},\n                      ${var:position} and ${var/substring/replacement}.\n                    type: object\n                  substituteFrom:\n                    description: SubstituteFrom holds references to ConfigMaps and\n                      Secrets containing the variables and their values to be substituted\n                      in the YAML manifests. The ConfigMap and the Secret data keys\n                      represent the var names and they must match the vars declared\n                      in the manifests for the substitution to happen.\n                    items:\n                      description: SubstituteReference contains a reference to a resource\n                        containing the variables name and value.\n                      properties:\n                        kind:\n                          description: Kind of the values referent, valid values are\n                            ('Secret', 'ConfigMap').\n                          enum:\n                          - Secret\n                          - ConfigMap\n                          type: string\n                        name:\n                          description: Name of the values referent. Should reside\n                            in the same namespace as the referring resource.\n                          maxLength: 253\n                          minLength: 1\n                          type: string\n                        optional:\n                          default: false\n                          description: Optional indicates whether the referenced resource\n                            must exist, or whether to tolerate its absence. If true\n                            and the referenced resource is absent, proceed as if the\n                            resource was present but empty, without any variables\n                            defined.\n                          type: boolean\n                      required:\n                      - kind\n                      - name\n                      type: object\n                    type: array\n                type: object\n              prune:\n                description: Prune enables garbage collection.\n                type: boolean\n              retryInterval:\n                description: The interval at which to retry a previously failed reconciliation.\n                  When not specified, the controller uses the KustomizationSpec.Interval\n                  value to retry failures.\n                type: string\n              serviceAccountName:\n                description: The name of the Kubernetes service account to impersonate\n                  when reconciling this Kustomization.\n                type: string\n              sourceRef:\n                description: Reference of the source where the kustomization file\n                  is.\n                properties:\n                  apiVersion:\n                    description: API version of the referent.\n                    type: string\n                  kind:\n                    description: Kind of the referent.\n                    enum:\n                    - GitRepository\n                    - Bucket\n                    type: string\n                  name:\n                    description: Name of the referent.\n                    type: string\n                  namespace:\n                    description: Namespace of the referent, defaults to the namespace\n                      of the Kubernetes resource object that contains the reference.\n                    type: string\n                required:\n                - kind\n                - name\n                type: object\n              suspend:\n                description: This flag tells the controller to suspend subsequent\n                  kustomize executions, it does not apply to already started executions.\n                  Defaults to false.\n                type: boolean\n              targetNamespace:\n                description: TargetNamespace sets or overrides the namespace in the\n                  kustomization.yaml file.\n                maxLength: 63\n                minLength: 1\n                type: string\n              timeout:\n                description: Timeout for validation, apply and health checking operations.\n                  Defaults to 'Interval' duration.\n                type: string\n              validation:\n                description: 'Deprecated: Not used in v1beta2.'\n                enum:\n                - none\n                - client\n                - server\n                type: string\n              wait:\n                description: Wait instructs the controller to check the health of\n                  all the reconciled resources. When enabled, the HealthChecks are\n                  ignored. Defaults to false.\n                type: boolean\n            required:\n            - interval\n            - prune\n            - sourceRef\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: KustomizationStatus defines the observed state of a kustomization.\n            properties:\n              conditions:\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              inventory:\n                description: Inventory contains the list of Kubernetes resource object\n                  references that have been successfully applied.\n                properties:\n                  entries:\n                    description: Entries of Kubernetes resource object references.\n                    items:\n                      description: ResourceRef contains the information necessary\n                        to locate a resource within a cluster.\n                      properties:\n                        id:\n                          description: ID is the string representation of the Kubernetes\n                            resource object's metadata, in the format '\u003cnamespace\u003e_\u003cname\u003e_\u003cgroup\u003e_\u003ckind\u003e'.\n                          type: string\n                        v:\n                          description: Version is the API version of the Kubernetes\n                            resource object's kind.\n                          type: string\n                      required:\n                      - id\n                      - v\n                      type: object\n                    type: array\n                required:\n                - entries\n                type: object\n              lastAppliedRevision:\n                description: The last successfully applied revision. The revision\n                  format for Git sources is \u003cbranch|tag\u003e/\u003ccommit-sha\u003e.\n                type: string\n              lastAttemptedRevision:\n                description: LastAttemptedRevision is the revision of the last reconciliation\n                  attempt.\n                type: string\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last reconciled generation.\n                format: int64\n                type: integer\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []",
+            "yaml_body_parsed": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: kustomizations.kustomize.toolkit.fluxcd.io\nspec:\n  group: kustomize.toolkit.fluxcd.io\n  names:\n    kind: Kustomization\n    listKind: KustomizationList\n    plural: kustomizations\n    shortNames:\n    - ks\n    singular: kustomization\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    name: v1beta1\n    schema:\n      openAPIV3Schema:\n        description: Kustomization is the Schema for the kustomizations API.\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: KustomizationSpec defines the desired state of a kustomization.\n            properties:\n              decryption:\n                description: Decrypt Kubernetes secrets before applying them on the\n                  cluster.\n                properties:\n                  provider:\n                    description: Provider is the name of the decryption engine.\n                    enum:\n                    - sops\n                    type: string\n                  secretRef:\n                    description: The secret name containing the private OpenPGP keys\n                      used for decryption.\n                    properties:\n                      name:\n                        description: Name of the referent.\n                        type: string\n                    required:\n                    - name\n                    type: object\n                required:\n                - provider\n                type: object\n              dependsOn:\n                description: DependsOn may contain a meta.NamespacedObjectReference\n                  slice with references to Kustomization resources that must be ready\n                  before this Kustomization can be reconciled.\n                items:\n                  description: NamespacedObjectReference contains enough information\n                    to locate the referenced Kubernetes resource object in any namespace.\n                  properties:\n                    name:\n                      description: Name of the referent.\n                      type: string\n                    namespace:\n                      description: Namespace of the referent, when not specified it\n                        acts as LocalObjectReference.\n                      type: string\n                  required:\n                  - name\n                  type: object\n                type: array\n              force:\n                default: false\n                description: Force instructs the controller to recreate resources\n                  when patching fails due to an immutable field change.\n                type: boolean\n              healthChecks:\n                description: A list of resources to be included in the health assessment.\n                items:\n                  description: NamespacedObjectKindReference contains enough information\n                    to locate the typed referenced Kubernetes resource object in any\n                    namespace.\n                  properties:\n                    apiVersion:\n                      description: API version of the referent, if not specified the\n                        Kubernetes preferred version will be used.\n                      type: string\n                    kind:\n                      description: Kind of the referent.\n                      type: string\n                    name:\n                      description: Name of the referent.\n                      type: string\n                    namespace:\n                      description: Namespace of the referent, when not specified it\n                        acts as LocalObjectReference.\n                      type: string\n                  required:\n                  - kind\n                  - name\n                  type: object\n                type: array\n              images:\n                description: Images is a list of (image name, new name, new tag or\n                  digest) for changing image names, tags or digests. This can also\n                  be achieved with a patch, but this operator is simpler to specify.\n                items:\n                  description: Image contains an image name, a new name, a new tag\n                    or digest, which will replace the original name and tag.\n                  properties:\n                    digest:\n                      description: Digest is the value used to replace the original\n                        image tag. If digest is present NewTag value is ignored.\n                      type: string\n                    name:\n                      description: Name is a tag-less image name.\n                      type: string\n                    newName:\n                      description: NewName is the value used to replace the original\n                        name.\n                      type: string\n                    newTag:\n                      description: NewTag is the value used to replace the original\n                        tag.\n                      type: string\n                  required:\n                  - name\n                  type: object\n                type: array\n              interval:\n                description: The interval at which to reconcile the Kustomization.\n                type: string\n              kubeConfig:\n                description: The KubeConfig for reconciling the Kustomization on a\n                  remote cluster. When specified, KubeConfig takes precedence over\n                  ServiceAccountName.\n                properties:\n                  secretRef:\n                    description: SecretRef holds the name to a secret that contains\n                      a 'value' key with the kubeconfig file as the value. It must\n                      be in the same namespace as the Kustomization. It is recommended\n                      that the kubeconfig is self-contained, and the secret is regularly\n                      updated if credentials such as a cloud-access-token expire.\n                      Cloud specific `cmd-path` auth helpers will not function without\n                      adding binaries and credentials to the Pod that is responsible\n                      for reconciling the Kustomization.\n                    properties:\n                      name:\n                        description: Name of the referent.\n                        type: string\n                    required:\n                    - name\n                    type: object\n                type: object\n              patches:\n                description: Strategic merge and JSON patches, defined as inline YAML\n                  objects, capable of targeting objects based on kind, label and annotation\n                  selectors.\n                items:\n                  description: Patch contains an inline StrategicMerge or JSON6902\n                    patch, and the target the patch should be applied to.\n                  properties:\n                    patch:\n                      description: Patch contains an inline StrategicMerge patch or\n                        an inline JSON6902 patch with an array of operation objects.\n                      type: string\n                    target:\n                      description: Target points to the resources that the patch document\n                        should be applied to.\n                      properties:\n                        annotationSelector:\n                          description: AnnotationSelector is a string that follows\n                            the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                            It matches with the resource annotations.\n                          type: string\n                        group:\n                          description: Group is the API group to select resources\n                            from. Together with Version and Kind it is capable of\n                            unambiguously identifying and/or selecting resources.\n                            https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                        kind:\n                          description: Kind of the API Group to select resources from.\n                            Together with Group and Version it is capable of unambiguously\n                            identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                        labelSelector:\n                          description: LabelSelector is a string that follows the\n                            label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                            It matches with the resource labels.\n                          type: string\n                        name:\n                          description: Name to match resources with.\n                          type: string\n                        namespace:\n                          description: Namespace to select resources from.\n                          type: string\n                        version:\n                          description: Version of the API Group to select resources\n                            from. Together with Group and Kind it is capable of unambiguously\n                            identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                      type: object\n                  type: object\n                type: array\n              patchesJson6902:\n                description: JSON 6902 patches, defined as inline YAML objects.\n                items:\n                  description: JSON6902Patch contains a JSON6902 patch and the target\n                    the patch should be applied to.\n                  properties:\n                    patch:\n                      description: Patch contains the JSON6902 patch document with\n                        an array of operation objects.\n                      items:\n                        description: JSON6902 is a JSON6902 operation object. https://datatracker.ietf.org/doc/html/rfc6902#section-4\n                        properties:\n                          from:\n                            description: From contains a JSON-pointer value that references\n                              a location within the target document where the operation\n                              is performed. The meaning of the value depends on the\n                              value of Op, and is NOT taken into account by all operations.\n                            type: string\n                          op:\n                            description: Op indicates the operation to perform. Its\n                              value MUST be one of \"add\", \"remove\", \"replace\", \"move\",\n                              \"copy\", or \"test\". https://datatracker.ietf.org/doc/html/rfc6902#section-4\n                            enum:\n                            - test\n                            - remove\n                            - add\n                            - replace\n                            - move\n                            - copy\n                            type: string\n                          path:\n                            description: Path contains the JSON-pointer value that\n                              references a location within the target document where\n                              the operation is performed. The meaning of the value\n                              depends on the value of Op.\n                            type: string\n                          value:\n                            description: Value contains a valid JSON structure. The\n                              meaning of the value depends on the value of Op, and\n                              is NOT taken into account by all operations.\n                            x-kubernetes-preserve-unknown-fields: true\n                        required:\n                        - op\n                        - path\n                        type: object\n                      type: array\n                    target:\n                      description: Target points to the resources that the patch document\n                        should be applied to.\n                      properties:\n                        annotationSelector:\n                          description: AnnotationSelector is a string that follows\n                            the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                            It matches with the resource annotations.\n                          type: string\n                        group:\n                          description: Group is the API group to select resources\n                            from. Together with Version and Kind it is capable of\n                            unambiguously identifying and/or selecting resources.\n                            https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                        kind:\n                          description: Kind of the API Group to select resources from.\n                            Together with Group and Version it is capable of unambiguously\n                            identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                        labelSelector:\n                          description: LabelSelector is a string that follows the\n                            label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                            It matches with the resource labels.\n                          type: string\n                        name:\n                          description: Name to match resources with.\n                          type: string\n                        namespace:\n                          description: Namespace to select resources from.\n                          type: string\n                        version:\n                          description: Version of the API Group to select resources\n                            from. Together with Group and Kind it is capable of unambiguously\n                            identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                      type: object\n                  required:\n                  - patch\n                  - target\n                  type: object\n                type: array\n              patchesStrategicMerge:\n                description: Strategic merge patches, defined as inline YAML objects.\n                items:\n                  x-kubernetes-preserve-unknown-fields: true\n                type: array\n              path:\n                description: Path to the directory containing the kustomization.yaml\n                  file, or the set of plain YAMLs a kustomization.yaml should be generated\n                  for. Defaults to 'None', which translates to the root path of the\n                  SourceRef.\n                type: string\n              postBuild:\n                description: PostBuild describes which actions to perform on the YAML\n                  manifest generated by building the kustomize overlay.\n                properties:\n                  substitute:\n                    additionalProperties:\n                      type: string\n                    description: Substitute holds a map of key/value pairs. The variables\n                      defined in your YAML manifests that match any of the keys defined\n                      in the map will be substituted with the set value. Includes\n                      support for bash string replacement functions e.g. ${var:=default},\n                      ${var:position} and ${var/substring/replacement}.\n                    type: object\n                  substituteFrom:\n                    description: SubstituteFrom holds references to ConfigMaps and\n                      Secrets containing the variables and their values to be substituted\n                      in the YAML manifests. The ConfigMap and the Secret data keys\n                      represent the var names and they must match the vars declared\n                      in the manifests for the substitution to happen.\n                    items:\n                      description: SubstituteReference contains a reference to a resource\n                        containing the variables name and value.\n                      properties:\n                        kind:\n                          description: Kind of the values referent, valid values are\n                            ('Secret', 'ConfigMap').\n                          enum:\n                          - Secret\n                          - ConfigMap\n                          type: string\n                        name:\n                          description: Name of the values referent. Should reside\n                            in the same namespace as the referring resource.\n                          maxLength: 253\n                          minLength: 1\n                          type: string\n                      required:\n                      - kind\n                      - name\n                      type: object\n                    type: array\n                type: object\n              prune:\n                description: Prune enables garbage collection.\n                type: boolean\n              retryInterval:\n                description: The interval at which to retry a previously failed reconciliation.\n                  When not specified, the controller uses the KustomizationSpec.Interval\n                  value to retry failures.\n                type: string\n              serviceAccountName:\n                description: The name of the Kubernetes service account to impersonate\n                  when reconciling this Kustomization.\n                type: string\n              sourceRef:\n                description: Reference of the source where the kustomization file\n                  is.\n                properties:\n                  apiVersion:\n                    description: API version of the referent\n                    type: string\n                  kind:\n                    description: Kind of the referent\n                    enum:\n                    - GitRepository\n                    - Bucket\n                    type: string\n                  name:\n                    description: Name of the referent\n                    type: string\n                  namespace:\n                    description: Namespace of the referent, defaults to the Kustomization\n                      namespace\n                    type: string\n                required:\n                - kind\n                - name\n                type: object\n              suspend:\n                description: This flag tells the controller to suspend subsequent\n                  kustomize executions, it does not apply to already started executions.\n                  Defaults to false.\n                type: boolean\n              targetNamespace:\n                description: TargetNamespace sets or overrides the namespace in the\n                  kustomization.yaml file.\n                maxLength: 63\n                minLength: 1\n                type: string\n              timeout:\n                description: Timeout for validation, apply and health checking operations.\n                  Defaults to 'Interval' duration.\n                type: string\n              validation:\n                description: Validate the Kubernetes objects before applying them\n                  on the cluster. The validation strategy can be 'client' (local dry-run),\n                  'server' (APIServer dry-run) or 'none'. When 'Force' is 'true',\n                  validation will fallback to 'client' if set to 'server' because\n                  server-side validation is not supported in this scenario.\n                enum:\n                - none\n                - client\n                - server\n                type: string\n            required:\n            - interval\n            - prune\n            - sourceRef\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: KustomizationStatus defines the observed state of a kustomization.\n            properties:\n              conditions:\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              lastAppliedRevision:\n                description: The last successfully applied revision. The revision\n                  format for Git sources is \u003cbranch|tag\u003e/\u003ccommit-sha\u003e.\n                type: string\n              lastAttemptedRevision:\n                description: LastAttemptedRevision is the revision of the last reconciliation\n                  attempt.\n                type: string\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last reconciled generation.\n                format: int64\n                type: integer\n              snapshot:\n                description: The last successfully applied revision metadata.\n                properties:\n                  checksum:\n                    description: The manifests sha1 checksum.\n                    type: string\n                  entries:\n                    description: A list of Kubernetes kinds grouped by namespace.\n                    items:\n                      description: Snapshot holds the metadata of namespaced Kubernetes\n                        objects\n                      properties:\n                        kinds:\n                          additionalProperties:\n                            type: string\n                          description: The list of Kubernetes kinds.\n                          type: object\n                        namespace:\n                          description: The namespace of this entry.\n                          type: string\n                      required:\n                      - kinds\n                      type: object\n                    type: array\n                required:\n                - checksum\n                - entries\n                type: object\n            type: object\n        type: object\n    served: true\n    storage: false\n    subresources:\n      status: {}\n  - additionalPrinterColumns:\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v1beta2\n    schema:\n      openAPIV3Schema:\n        description: Kustomization is the Schema for the kustomizations API.\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: KustomizationSpec defines the configuration to calculate\n              the desired state from a Source using Kustomize.\n            properties:\n              decryption:\n                description: Decrypt Kubernetes secrets before applying them on the\n                  cluster.\n                properties:\n                  provider:\n                    description: Provider is the name of the decryption engine.\n                    enum:\n                    - sops\n                    type: string\n                  secretRef:\n                    description: The secret name containing the private OpenPGP keys\n                      used for decryption.\n                    properties:\n                      name:\n                        description: Name of the referent.\n                        type: string\n                    required:\n                    - name\n                    type: object\n                required:\n                - provider\n                type: object\n              dependsOn:\n                description: DependsOn may contain a meta.NamespacedObjectReference\n                  slice with references to Kustomization resources that must be ready\n                  before this Kustomization can be reconciled.\n                items:\n                  description: NamespacedObjectReference contains enough information\n                    to locate the referenced Kubernetes resource object in any namespace.\n                  properties:\n                    name:\n                      description: Name of the referent.\n                      type: string\n                    namespace:\n                      description: Namespace of the referent, when not specified it\n                        acts as LocalObjectReference.\n                      type: string\n                  required:\n                  - name\n                  type: object\n                type: array\n              force:\n                default: false\n                description: Force instructs the controller to recreate resources\n                  when patching fails due to an immutable field change.\n                type: boolean\n              healthChecks:\n                description: A list of resources to be included in the health assessment.\n                items:\n                  description: NamespacedObjectKindReference contains enough information\n                    to locate the typed referenced Kubernetes resource object in any\n                    namespace.\n                  properties:\n                    apiVersion:\n                      description: API version of the referent, if not specified the\n                        Kubernetes preferred version will be used.\n                      type: string\n                    kind:\n                      description: Kind of the referent.\n                      type: string\n                    name:\n                      description: Name of the referent.\n                      type: string\n                    namespace:\n                      description: Namespace of the referent, when not specified it\n                        acts as LocalObjectReference.\n                      type: string\n                  required:\n                  - kind\n                  - name\n                  type: object\n                type: array\n              images:\n                description: Images is a list of (image name, new name, new tag or\n                  digest) for changing image names, tags or digests. This can also\n                  be achieved with a patch, but this operator is simpler to specify.\n                items:\n                  description: Image contains an image name, a new name, a new tag\n                    or digest, which will replace the original name and tag.\n                  properties:\n                    digest:\n                      description: Digest is the value used to replace the original\n                        image tag. If digest is present NewTag value is ignored.\n                      type: string\n                    name:\n                      description: Name is a tag-less image name.\n                      type: string\n                    newName:\n                      description: NewName is the value used to replace the original\n                        name.\n                      type: string\n                    newTag:\n                      description: NewTag is the value used to replace the original\n                        tag.\n                      type: string\n                  required:\n                  - name\n                  type: object\n                type: array\n              interval:\n                description: The interval at which to reconcile the Kustomization.\n                type: string\n              kubeConfig:\n                description: The KubeConfig for reconciling the Kustomization on a\n                  remote cluster. When used in combination with KustomizationSpec.ServiceAccountName,\n                  forces the controller to act on behalf of that Service Account at\n                  the target cluster. If the --default-service-account flag is set,\n                  its value will be used as a controller level fallback for when KustomizationSpec.ServiceAccountName\n                  is empty.\n                properties:\n                  secretRef:\n                    description: SecretRef holds the name of a secret that contains\n                      a key with the kubeconfig file as the value. If no key is set,\n                      the key will default to 'value'. The secret must be in the same\n                      namespace as the Kustomization. It is recommended that the kubeconfig\n                      is self-contained, and the secret is regularly updated if credentials\n                      such as a cloud-access-token expire. Cloud specific `cmd-path`\n                      auth helpers will not function without adding binaries and credentials\n                      to the Pod that is responsible for reconciling the Kustomization.\n                    properties:\n                      key:\n                        description: Key in the Secret, when not specified an implementation-specific\n                          default key is used.\n                        type: string\n                      name:\n                        description: Name of the Secret.\n                        type: string\n                    required:\n                    - name\n                    type: object\n                type: object\n              patches:\n                description: Strategic merge and JSON patches, defined as inline YAML\n                  objects, capable of targeting objects based on kind, label and annotation\n                  selectors.\n                items:\n                  description: Patch contains an inline StrategicMerge or JSON6902\n                    patch, and the target the patch should be applied to.\n                  properties:\n                    patch:\n                      description: Patch contains an inline StrategicMerge patch or\n                        an inline JSON6902 patch with an array of operation objects.\n                      type: string\n                    target:\n                      description: Target points to the resources that the patch document\n                        should be applied to.\n                      properties:\n                        annotationSelector:\n                          description: AnnotationSelector is a string that follows\n                            the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                            It matches with the resource annotations.\n                          type: string\n                        group:\n                          description: Group is the API group to select resources\n                            from. Together with Version and Kind it is capable of\n                            unambiguously identifying and/or selecting resources.\n                            https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                        kind:\n                          description: Kind of the API Group to select resources from.\n                            Together with Group and Version it is capable of unambiguously\n                            identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                        labelSelector:\n                          description: LabelSelector is a string that follows the\n                            label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                            It matches with the resource labels.\n                          type: string\n                        name:\n                          description: Name to match resources with.\n                          type: string\n                        namespace:\n                          description: Namespace to select resources from.\n                          type: string\n                        version:\n                          description: Version of the API Group to select resources\n                            from. Together with Group and Kind it is capable of unambiguously\n                            identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                      type: object\n                  type: object\n                type: array\n              patchesJson6902:\n                description: 'JSON 6902 patches, defined as inline YAML objects. Deprecated:\n                  Use Patches instead.'\n                items:\n                  description: JSON6902Patch contains a JSON6902 patch and the target\n                    the patch should be applied to.\n                  properties:\n                    patch:\n                      description: Patch contains the JSON6902 patch document with\n                        an array of operation objects.\n                      items:\n                        description: JSON6902 is a JSON6902 operation object. https://datatracker.ietf.org/doc/html/rfc6902#section-4\n                        properties:\n                          from:\n                            description: From contains a JSON-pointer value that references\n                              a location within the target document where the operation\n                              is performed. The meaning of the value depends on the\n                              value of Op, and is NOT taken into account by all operations.\n                            type: string\n                          op:\n                            description: Op indicates the operation to perform. Its\n                              value MUST be one of \"add\", \"remove\", \"replace\", \"move\",\n                              \"copy\", or \"test\". https://datatracker.ietf.org/doc/html/rfc6902#section-4\n                            enum:\n                            - test\n                            - remove\n                            - add\n                            - replace\n                            - move\n                            - copy\n                            type: string\n                          path:\n                            description: Path contains the JSON-pointer value that\n                              references a location within the target document where\n                              the operation is performed. The meaning of the value\n                              depends on the value of Op.\n                            type: string\n                          value:\n                            description: Value contains a valid JSON structure. The\n                              meaning of the value depends on the value of Op, and\n                              is NOT taken into account by all operations.\n                            x-kubernetes-preserve-unknown-fields: true\n                        required:\n                        - op\n                        - path\n                        type: object\n                      type: array\n                    target:\n                      description: Target points to the resources that the patch document\n                        should be applied to.\n                      properties:\n                        annotationSelector:\n                          description: AnnotationSelector is a string that follows\n                            the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                            It matches with the resource annotations.\n                          type: string\n                        group:\n                          description: Group is the API group to select resources\n                            from. Together with Version and Kind it is capable of\n                            unambiguously identifying and/or selecting resources.\n                            https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                        kind:\n                          description: Kind of the API Group to select resources from.\n                            Together with Group and Version it is capable of unambiguously\n                            identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                        labelSelector:\n                          description: LabelSelector is a string that follows the\n                            label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\n                            It matches with the resource labels.\n                          type: string\n                        name:\n                          description: Name to match resources with.\n                          type: string\n                        namespace:\n                          description: Namespace to select resources from.\n                          type: string\n                        version:\n                          description: Version of the API Group to select resources\n                            from. Together with Group and Kind it is capable of unambiguously\n                            identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md\n                          type: string\n                      type: object\n                  required:\n                  - patch\n                  - target\n                  type: object\n                type: array\n              patchesStrategicMerge:\n                description: 'Strategic merge patches, defined as inline YAML objects.\n                  Deprecated: Use Patches instead.'\n                items:\n                  x-kubernetes-preserve-unknown-fields: true\n                type: array\n              path:\n                description: Path to the directory containing the kustomization.yaml\n                  file, or the set of plain YAMLs a kustomization.yaml should be generated\n                  for. Defaults to 'None', which translates to the root path of the\n                  SourceRef.\n                type: string\n              postBuild:\n                description: PostBuild describes which actions to perform on the YAML\n                  manifest generated by building the kustomize overlay.\n                properties:\n                  substitute:\n                    additionalProperties:\n                      type: string\n                    description: Substitute holds a map of key/value pairs. The variables\n                      defined in your YAML manifests that match any of the keys defined\n                      in the map will be substituted with the set value. Includes\n                      support for bash string replacement functions e.g. ${var:=default},\n                      ${var:position} and ${var/substring/replacement}.\n                    type: object\n                  substituteFrom:\n                    description: SubstituteFrom holds references to ConfigMaps and\n                      Secrets containing the variables and their values to be substituted\n                      in the YAML manifests. The ConfigMap and the Secret data keys\n                      represent the var names and they must match the vars declared\n                      in the manifests for the substitution to happen.\n                    items:\n                      description: SubstituteReference contains a reference to a resource\n                        containing the variables name and value.\n                      properties:\n                        kind:\n                          description: Kind of the values referent, valid values are\n                            ('Secret', 'ConfigMap').\n                          enum:\n                          - Secret\n                          - ConfigMap\n                          type: string\n                        name:\n                          description: Name of the values referent. Should reside\n                            in the same namespace as the referring resource.\n                          maxLength: 253\n                          minLength: 1\n                          type: string\n                        optional:\n                          default: false\n                          description: Optional indicates whether the referenced resource\n                            must exist, or whether to tolerate its absence. If true\n                            and the referenced resource is absent, proceed as if the\n                            resource was present but empty, without any variables\n                            defined.\n                          type: boolean\n                      required:\n                      - kind\n                      - name\n                      type: object\n                    type: array\n                type: object\n              prune:\n                description: Prune enables garbage collection.\n                type: boolean\n              retryInterval:\n                description: The interval at which to retry a previously failed reconciliation.\n                  When not specified, the controller uses the KustomizationSpec.Interval\n                  value to retry failures.\n                type: string\n              serviceAccountName:\n                description: The name of the Kubernetes service account to impersonate\n                  when reconciling this Kustomization.\n                type: string\n              sourceRef:\n                description: Reference of the source where the kustomization file\n                  is.\n                properties:\n                  apiVersion:\n                    description: API version of the referent.\n                    type: string\n                  kind:\n                    description: Kind of the referent.\n                    enum:\n                    - GitRepository\n                    - Bucket\n                    type: string\n                  name:\n                    description: Name of the referent.\n                    type: string\n                  namespace:\n                    description: Namespace of the referent, defaults to the namespace\n                      of the Kubernetes resource object that contains the reference.\n                    type: string\n                required:\n                - kind\n                - name\n                type: object\n              suspend:\n                description: This flag tells the controller to suspend subsequent\n                  kustomize executions, it does not apply to already started executions.\n                  Defaults to false.\n                type: boolean\n              targetNamespace:\n                description: TargetNamespace sets or overrides the namespace in the\n                  kustomization.yaml file.\n                maxLength: 63\n                minLength: 1\n                type: string\n              timeout:\n                description: Timeout for validation, apply and health checking operations.\n                  Defaults to 'Interval' duration.\n                type: string\n              validation:\n                description: 'Deprecated: Not used in v1beta2.'\n                enum:\n                - none\n                - client\n                - server\n                type: string\n              wait:\n                description: Wait instructs the controller to check the health of\n                  all the reconciled resources. When enabled, the HealthChecks are\n                  ignored. Defaults to false.\n                type: boolean\n            required:\n            - interval\n            - prune\n            - sourceRef\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: KustomizationStatus defines the observed state of a kustomization.\n            properties:\n              conditions:\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              inventory:\n                description: Inventory contains the list of Kubernetes resource object\n                  references that have been successfully applied.\n                properties:\n                  entries:\n                    description: Entries of Kubernetes resource object references.\n                    items:\n                      description: ResourceRef contains the information necessary\n                        to locate a resource within a cluster.\n                      properties:\n                        id:\n                          description: ID is the string representation of the Kubernetes\n                            resource object's metadata, in the format '\u003cnamespace\u003e_\u003cname\u003e_\u003cgroup\u003e_\u003ckind\u003e'.\n                          type: string\n                        v:\n                          description: Version is the API version of the Kubernetes\n                            resource object's kind.\n                          type: string\n                      required:\n                      - id\n                      - v\n                      type: object\n                    type: array\n                required:\n                - entries\n                type: object\n              lastAppliedRevision:\n                description: The last successfully applied revision. The revision\n                  format for Git sources is \u003cbranch|tag\u003e/\u003ccommit-sha\u003e.\n                type: string\n              lastAttemptedRevision:\n                description: LastAttemptedRevision is the revision of the last reconciliation\n                  attempt.\n                type: string\n              lastHandledReconcileAt:\n                description: LastHandledReconcileAt holds the value of the most recent\n                  reconcile request value, so a change of the annotation value can\n                  be detected.\n                type: string\n              observedGeneration:\n                description: ObservedGeneration is the last reconciled generation.\n                format: int64\n                type: integer\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []\n",
+            "yaml_incluster": "fd7e8602f5c8f9c751fc481764ee8c7fbe00c1e39e611464521002e45fb44580"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "apiextensions.k8s.io/v1/customresourcedefinition/providers.notification.toolkit.fluxcd.io",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "apiextensions.k8s.io/v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions/providers.notification.toolkit.fluxcd.io",
+            "ignore_fields": null,
+            "kind": "CustomResourceDefinition",
+            "live_manifest_incluster": "faeef9c1996db75461977384cdc5289aeecc9c3b200860f9aeaad7144e0a6d85",
+            "live_uid": "398ef839-005c-4b63-a0e1-4cf8c27ed8e4",
+            "name": "providers.notification.toolkit.fluxcd.io",
+            "namespace": null,
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "398ef839-005c-4b63-a0e1-4cf8c27ed8e4",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: providers.notification.toolkit.fluxcd.io\nspec:\n  group: notification.toolkit.fluxcd.io\n  names:\n    kind: Provider\n    listKind: ProviderList\n    plural: providers\n    singular: provider\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v1beta1\n    schema:\n      openAPIV3Schema:\n        description: Provider is the Schema for the providers API\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: ProviderSpec defines the desired state of Provider\n            properties:\n              address:\n                description: HTTP/S webhook address of this provider\n                pattern: ^(http|https)://\n                type: string\n              certSecretRef:\n                description: CertSecretRef can be given the name of a secret containing\n                  a PEM-encoded CA certificate (`caFile`)\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              channel:\n                description: Alert channel for this provider\n                type: string\n              proxy:\n                description: HTTP/S address of the proxy\n                pattern: ^(http|https)://\n                type: string\n              secretRef:\n                description: Secret reference containing the provider webhook URL\n                  using \"address\" as data key\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              suspend:\n                description: This flag tells the controller to suspend subsequent\n                  events handling. Defaults to false.\n                type: boolean\n              type:\n                description: Type of provider\n                enum:\n                - slack\n                - discord\n                - msteams\n                - rocket\n                - generic\n                - github\n                - gitlab\n                - bitbucket\n                - azuredevops\n                - googlechat\n                - webex\n                - sentry\n                - azureeventhub\n                - telegram\n                - lark\n                - matrix\n                - opsgenie\n                - alertmanager\n                - grafana\n                type: string\n              username:\n                description: Bot username for this provider\n                type: string\n            required:\n            - type\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: ProviderStatus defines the observed state of Provider\n            properties:\n              conditions:\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              observedGeneration:\n                description: ObservedGeneration is the last reconciled generation.\n                format: int64\n                type: integer\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []",
+            "yaml_body_parsed": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: providers.notification.toolkit.fluxcd.io\nspec:\n  group: notification.toolkit.fluxcd.io\n  names:\n    kind: Provider\n    listKind: ProviderList\n    plural: providers\n    singular: provider\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v1beta1\n    schema:\n      openAPIV3Schema:\n        description: Provider is the Schema for the providers API\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: ProviderSpec defines the desired state of Provider\n            properties:\n              address:\n                description: HTTP/S webhook address of this provider\n                pattern: ^(http|https)://\n                type: string\n              certSecretRef:\n                description: CertSecretRef can be given the name of a secret containing\n                  a PEM-encoded CA certificate (`caFile`)\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              channel:\n                description: Alert channel for this provider\n                type: string\n              proxy:\n                description: HTTP/S address of the proxy\n                pattern: ^(http|https)://\n                type: string\n              secretRef:\n                description: Secret reference containing the provider webhook URL\n                  using \"address\" as data key\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              suspend:\n                description: This flag tells the controller to suspend subsequent\n                  events handling. Defaults to false.\n                type: boolean\n              type:\n                description: Type of provider\n                enum:\n                - slack\n                - discord\n                - msteams\n                - rocket\n                - generic\n                - github\n                - gitlab\n                - bitbucket\n                - azuredevops\n                - googlechat\n                - webex\n                - sentry\n                - azureeventhub\n                - telegram\n                - lark\n                - matrix\n                - opsgenie\n                - alertmanager\n                - grafana\n                type: string\n              username:\n                description: Bot username for this provider\n                type: string\n            required:\n            - type\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: ProviderStatus defines the observed state of Provider\n            properties:\n              conditions:\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              observedGeneration:\n                description: ObservedGeneration is the last reconciled generation.\n                format: int64\n                type: integer\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []\n",
+            "yaml_incluster": "faeef9c1996db75461977384cdc5289aeecc9c3b200860f9aeaad7144e0a6d85"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "apiextensions.k8s.io/v1/customresourcedefinition/receivers.notification.toolkit.fluxcd.io",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "apiextensions.k8s.io/v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions/receivers.notification.toolkit.fluxcd.io",
+            "ignore_fields": null,
+            "kind": "CustomResourceDefinition",
+            "live_manifest_incluster": "a5c61c680526fbad949575b286791b8f9e17af94bead5575a34e08e55754d743",
+            "live_uid": "078824fd-21f8-4a80-bc34-ba5f397352a6",
+            "name": "receivers.notification.toolkit.fluxcd.io",
+            "namespace": null,
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "078824fd-21f8-4a80-bc34-ba5f397352a6",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: receivers.notification.toolkit.fluxcd.io\nspec:\n  group: notification.toolkit.fluxcd.io\n  names:\n    kind: Receiver\n    listKind: ReceiverList\n    plural: receivers\n    singular: receiver\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v1beta1\n    schema:\n      openAPIV3Schema:\n        description: Receiver is the Schema for the receivers API\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: ReceiverSpec defines the desired state of Receiver\n            properties:\n              events:\n                description: A list of events to handle, e.g. 'push' for GitHub or\n                  'Push Hook' for GitLab.\n                items:\n                  type: string\n                type: array\n              resources:\n                description: A list of resources to be notified about changes.\n                items:\n                  description: CrossNamespaceObjectReference contains enough information\n                    to let you locate the typed referenced object at cluster level\n                  properties:\n                    apiVersion:\n                      description: API version of the referent\n                      type: string\n                    kind:\n                      description: Kind of the referent\n                      enum:\n                      - Bucket\n                      - GitRepository\n                      - Kustomization\n                      - HelmRelease\n                      - HelmChart\n                      - HelmRepository\n                      - ImageRepository\n                      - ImagePolicy\n                      - ImageUpdateAutomation\n                      type: string\n                    matchLabels:\n                      additionalProperties:\n                        type: string\n                      description: MatchLabels is a map of {key,value} pairs. A single\n                        {key,value} in the matchLabels map is equivalent to an element\n                        of matchExpressions, whose key field is \"key\", the operator\n                        is \"In\", and the values array contains only \"value\". The requirements\n                        are ANDed.\n                      type: object\n                    name:\n                      description: Name of the referent\n                      maxLength: 53\n                      minLength: 1\n                      type: string\n                    namespace:\n                      description: Namespace of the referent\n                      maxLength: 53\n                      minLength: 1\n                      type: string\n                  required:\n                  - name\n                  type: object\n                type: array\n              secretRef:\n                description: Secret reference containing the token used to validate\n                  the payload authenticity\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              suspend:\n                description: This flag tells the controller to suspend subsequent\n                  events handling. Defaults to false.\n                type: boolean\n              type:\n                description: Type of webhook sender, used to determine the validation\n                  procedure and payload deserialization.\n                enum:\n                - generic\n                - generic-hmac\n                - github\n                - gitlab\n                - bitbucket\n                - harbor\n                - dockerhub\n                - quay\n                - gcr\n                - nexus\n                - acr\n                type: string\n            required:\n            - resources\n            - type\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: ReceiverStatus defines the observed state of Receiver\n            properties:\n              conditions:\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation.\n                format: int64\n                type: integer\n              url:\n                description: Generated webhook URL in the format of '/hook/sha256sum(token+name+namespace)'.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []",
+            "yaml_body_parsed": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\nmetadata:\n  annotations:\n    controller-gen.kubebuilder.io/version: v0.7.0\n  creationTimestamp: null\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: receivers.notification.toolkit.fluxcd.io\nspec:\n  group: notification.toolkit.fluxcd.io\n  names:\n    kind: Receiver\n    listKind: ReceiverList\n    plural: receivers\n    singular: receiver\n  scope: Namespaced\n  versions:\n  - additionalPrinterColumns:\n    - jsonPath: .metadata.creationTimestamp\n      name: Age\n      type: date\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].status\n      name: Ready\n      type: string\n    - jsonPath: .status.conditions[?(@.type==\"Ready\")].message\n      name: Status\n      type: string\n    name: v1beta1\n    schema:\n      openAPIV3Schema:\n        description: Receiver is the Schema for the receivers API\n        properties:\n          apiVersion:\n            description: 'APIVersion defines the versioned schema of this representation\n              of an object. Servers should convert recognized schemas to the latest\n              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'\n            type: string\n          kind:\n            description: 'Kind is a string value representing the REST resource this\n              object represents. Servers may infer this from the endpoint the client\n              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'\n            type: string\n          metadata:\n            type: object\n          spec:\n            description: ReceiverSpec defines the desired state of Receiver\n            properties:\n              events:\n                description: A list of events to handle, e.g. 'push' for GitHub or\n                  'Push Hook' for GitLab.\n                items:\n                  type: string\n                type: array\n              resources:\n                description: A list of resources to be notified about changes.\n                items:\n                  description: CrossNamespaceObjectReference contains enough information\n                    to let you locate the typed referenced object at cluster level\n                  properties:\n                    apiVersion:\n                      description: API version of the referent\n                      type: string\n                    kind:\n                      description: Kind of the referent\n                      enum:\n                      - Bucket\n                      - GitRepository\n                      - Kustomization\n                      - HelmRelease\n                      - HelmChart\n                      - HelmRepository\n                      - ImageRepository\n                      - ImagePolicy\n                      - ImageUpdateAutomation\n                      type: string\n                    matchLabels:\n                      additionalProperties:\n                        type: string\n                      description: MatchLabels is a map of {key,value} pairs. A single\n                        {key,value} in the matchLabels map is equivalent to an element\n                        of matchExpressions, whose key field is \"key\", the operator\n                        is \"In\", and the values array contains only \"value\". The requirements\n                        are ANDed.\n                      type: object\n                    name:\n                      description: Name of the referent\n                      maxLength: 53\n                      minLength: 1\n                      type: string\n                    namespace:\n                      description: Namespace of the referent\n                      maxLength: 53\n                      minLength: 1\n                      type: string\n                  required:\n                  - name\n                  type: object\n                type: array\n              secretRef:\n                description: Secret reference containing the token used to validate\n                  the payload authenticity\n                properties:\n                  name:\n                    description: Name of the referent.\n                    type: string\n                required:\n                - name\n                type: object\n              suspend:\n                description: This flag tells the controller to suspend subsequent\n                  events handling. Defaults to false.\n                type: boolean\n              type:\n                description: Type of webhook sender, used to determine the validation\n                  procedure and payload deserialization.\n                enum:\n                - generic\n                - generic-hmac\n                - github\n                - gitlab\n                - bitbucket\n                - harbor\n                - dockerhub\n                - quay\n                - gcr\n                - nexus\n                - acr\n                type: string\n            required:\n            - resources\n            - type\n            type: object\n          status:\n            default:\n              observedGeneration: -1\n            description: ReceiverStatus defines the observed state of Receiver\n            properties:\n              conditions:\n                items:\n                  description: \"Condition contains details for one aspect of the current\n                    state of this API Resource. --- This struct is intended for direct\n                    use as an array at the field path .status.conditions.  For example,\n                    type FooStatus struct{     // Represents the observations of a\n                    foo's current state.     // Known .status.conditions.type are:\n                    \\\"Available\\\", \\\"Progressing\\\", and \\\"Degraded\\\"     // +patchMergeKey=type\n                    \\    // +patchStrategy=merge     // +listType=map     // +listMapKey=type\n                    \\    Conditions []metav1.Condition `json:\\\"conditions,omitempty\\\"\n                    patchStrategy:\\\"merge\\\" patchMergeKey:\\\"type\\\" protobuf:\\\"bytes,1,rep,name=conditions\\\"`\n                    \\n     // other fields }\"\n                  properties:\n                    lastTransitionTime:\n                      description: lastTransitionTime is the last time the condition\n                        transitioned from one status to another. This should be when\n                        the underlying condition changed.  If that is not known, then\n                        using the time when the API field changed is acceptable.\n                      format: date-time\n                      type: string\n                    message:\n                      description: message is a human readable message indicating\n                        details about the transition. This may be an empty string.\n                      maxLength: 32768\n                      type: string\n                    observedGeneration:\n                      description: observedGeneration represents the .metadata.generation\n                        that the condition was set based upon. For instance, if .metadata.generation\n                        is currently 12, but the .status.conditions[x].observedGeneration\n                        is 9, the condition is out of date with respect to the current\n                        state of the instance.\n                      format: int64\n                      minimum: 0\n                      type: integer\n                    reason:\n                      description: reason contains a programmatic identifier indicating\n                        the reason for the condition's last transition. Producers\n                        of specific condition types may define expected values and\n                        meanings for this field, and whether the values are considered\n                        a guaranteed API. The value should be a CamelCase string.\n                        This field may not be empty.\n                      maxLength: 1024\n                      minLength: 1\n                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\n                      type: string\n                    status:\n                      description: status of the condition, one of True, False, Unknown.\n                      enum:\n                      - \"True\"\n                      - \"False\"\n                      - Unknown\n                      type: string\n                    type:\n                      description: type of condition in CamelCase or in foo.example.com/CamelCase.\n                        --- Many .condition.type values are consistent across resources\n                        like Available, but because arbitrary conditions can be useful\n                        (see .node.status.conditions), the ability to deconflict is\n                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\n                      maxLength: 316\n                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\n                      type: string\n                  required:\n                  - lastTransitionTime\n                  - message\n                  - reason\n                  - status\n                  - type\n                  type: object\n                type: array\n              observedGeneration:\n                description: ObservedGeneration is the last observed generation.\n                format: int64\n                type: integer\n              url:\n                description: Generated webhook URL in the format of '/hook/sha256sum(token+name+namespace)'.\n                type: string\n            type: object\n        type: object\n    served: true\n    storage: true\n    subresources:\n      status: {}\nstatus:\n  acceptedNames:\n    kind: \"\"\n    plural: \"\"\n  conditions: []\n  storedVersions: []\n",
+            "yaml_incluster": "a5c61c680526fbad949575b286791b8f9e17af94bead5575a34e08e55754d743"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "apps/v1/deployment/flux-system/helm-controller",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "apps/v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/apps/v1/namespaces/flux-system/deployments/helm-controller",
+            "ignore_fields": null,
+            "kind": "Deployment",
+            "live_manifest_incluster": "e4a3b3bfd6bd6ffd2658edf4addbe86e4de9eb9ed18ac572badad9ac837f4824",
+            "live_uid": "595c94bd-2897-4105-a6eb-f7f3d28aef31",
+            "name": "helm-controller",
+            "namespace": "flux-system",
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "595c94bd-2897-4105-a6eb-f7f3d28aef31",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n    control-plane: controller\n  name: helm-controller\n  namespace: flux-system\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: helm-controller\n  template:\n    metadata:\n      annotations:\n        prometheus.io/port: \"8080\"\n        prometheus.io/scrape: \"true\"\n      labels:\n        app: helm-controller\n    spec:\n      containers:\n      - args:\n        - --events-addr=http://notification-controller.flux-system.svc.cluster.local./\n        - --watch-all-namespaces=true\n        - --log-level=info\n        - --log-encoding=json\n        - --enable-leader-election\n        env:\n        - name: RUNTIME_NAMESPACE\n          valueFrom:\n            fieldRef:\n              fieldPath: metadata.namespace\n        image: ghcr.io/fluxcd/helm-controller:v0.21.0\n        imagePullPolicy: IfNotPresent\n        livenessProbe:\n          httpGet:\n            path: /healthz\n            port: healthz\n        name: manager\n        ports:\n        - containerPort: 8080\n          name: http-prom\n          protocol: TCP\n        - containerPort: 9440\n          name: healthz\n          protocol: TCP\n        readinessProbe:\n          httpGet:\n            path: /readyz\n            port: healthz\n        resources:\n          limits:\n            cpu: 1000m\n            memory: 1Gi\n          requests:\n            cpu: 100m\n            memory: 64Mi\n        securityContext:\n          allowPrivilegeEscalation: false\n          capabilities:\n            drop:\n            - ALL\n          readOnlyRootFilesystem: true\n          runAsNonRoot: true\n          seccompProfile:\n            type: RuntimeDefault\n        volumeMounts:\n        - mountPath: /tmp\n          name: temp\n      nodeSelector:\n        kubernetes.io/os: linux\n      securityContext:\n        fsGroup: 1337\n      serviceAccountName: helm-controller\n      terminationGracePeriodSeconds: 600\n      volumes:\n      - emptyDir: {}\n        name: temp",
+            "yaml_body_parsed": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n    control-plane: controller\n  name: helm-controller\n  namespace: flux-system\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: helm-controller\n  template:\n    metadata:\n      annotations:\n        prometheus.io/port: \"8080\"\n        prometheus.io/scrape: \"true\"\n      labels:\n        app: helm-controller\n    spec:\n      containers:\n      - args:\n        - --events-addr=http://notification-controller.flux-system.svc.cluster.local./\n        - --watch-all-namespaces=true\n        - --log-level=info\n        - --log-encoding=json\n        - --enable-leader-election\n        env:\n        - name: RUNTIME_NAMESPACE\n          valueFrom:\n            fieldRef:\n              fieldPath: metadata.namespace\n        image: ghcr.io/fluxcd/helm-controller:v0.21.0\n        imagePullPolicy: IfNotPresent\n        livenessProbe:\n          httpGet:\n            path: /healthz\n            port: healthz\n        name: manager\n        ports:\n        - containerPort: 8080\n          name: http-prom\n          protocol: TCP\n        - containerPort: 9440\n          name: healthz\n          protocol: TCP\n        readinessProbe:\n          httpGet:\n            path: /readyz\n            port: healthz\n        resources:\n          limits:\n            cpu: 1000m\n            memory: 1Gi\n          requests:\n            cpu: 100m\n            memory: 64Mi\n        securityContext:\n          allowPrivilegeEscalation: false\n          capabilities:\n            drop:\n            - ALL\n          readOnlyRootFilesystem: true\n          runAsNonRoot: true\n          seccompProfile:\n            type: RuntimeDefault\n        volumeMounts:\n        - mountPath: /tmp\n          name: temp\n      nodeSelector:\n        kubernetes.io/os: linux\n      securityContext:\n        fsGroup: 1337\n      serviceAccountName: helm-controller\n      terminationGracePeriodSeconds: 600\n      volumes:\n      - emptyDir: {}\n        name: temp\n",
+            "yaml_incluster": "e4a3b3bfd6bd6ffd2658edf4addbe86e4de9eb9ed18ac572badad9ac837f4824"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "apps/v1/deployment/flux-system/kustomize-controller",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "apps/v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/apps/v1/namespaces/flux-system/deployments/kustomize-controller",
+            "ignore_fields": null,
+            "kind": "Deployment",
+            "live_manifest_incluster": "2826c2c4389823e3aaf89d714a101f295d74b565e99bd2a4d7436ce727817cea",
+            "live_uid": "7ea37437-55b7-4168-883a-1754bbeccd07",
+            "name": "kustomize-controller",
+            "namespace": "flux-system",
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "7ea37437-55b7-4168-883a-1754bbeccd07",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n    control-plane: controller\n  name: kustomize-controller\n  namespace: flux-system\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: kustomize-controller\n  template:\n    metadata:\n      annotations:\n        prometheus.io/port: \"8080\"\n        prometheus.io/scrape: \"true\"\n      labels:\n        app: kustomize-controller\n    spec:\n      containers:\n      - args:\n        - --events-addr=http://notification-controller.flux-system.svc.cluster.local./\n        - --watch-all-namespaces=true\n        - --log-level=info\n        - --log-encoding=json\n        - --enable-leader-election\n        env:\n        - name: RUNTIME_NAMESPACE\n          valueFrom:\n            fieldRef:\n              fieldPath: metadata.namespace\n        image: ghcr.io/fluxcd/kustomize-controller:v0.25.0\n        imagePullPolicy: IfNotPresent\n        livenessProbe:\n          httpGet:\n            path: /healthz\n            port: healthz\n        name: manager\n        ports:\n        - containerPort: 8080\n          name: http-prom\n          protocol: TCP\n        - containerPort: 9440\n          name: healthz\n          protocol: TCP\n        readinessProbe:\n          httpGet:\n            path: /readyz\n            port: healthz\n        resources:\n          limits:\n            cpu: 1000m\n            memory: 1Gi\n          requests:\n            cpu: 100m\n            memory: 64Mi\n        securityContext:\n          allowPrivilegeEscalation: false\n          capabilities:\n            drop:\n            - ALL\n          readOnlyRootFilesystem: true\n          runAsNonRoot: true\n          seccompProfile:\n            type: RuntimeDefault\n        volumeMounts:\n        - mountPath: /tmp\n          name: temp\n      nodeSelector:\n        kubernetes.io/os: linux\n      securityContext:\n        fsGroup: 1337\n      serviceAccountName: kustomize-controller\n      terminationGracePeriodSeconds: 60\n      volumes:\n      - emptyDir: {}\n        name: temp",
+            "yaml_body_parsed": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n    control-plane: controller\n  name: kustomize-controller\n  namespace: flux-system\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: kustomize-controller\n  template:\n    metadata:\n      annotations:\n        prometheus.io/port: \"8080\"\n        prometheus.io/scrape: \"true\"\n      labels:\n        app: kustomize-controller\n    spec:\n      containers:\n      - args:\n        - --events-addr=http://notification-controller.flux-system.svc.cluster.local./\n        - --watch-all-namespaces=true\n        - --log-level=info\n        - --log-encoding=json\n        - --enable-leader-election\n        env:\n        - name: RUNTIME_NAMESPACE\n          valueFrom:\n            fieldRef:\n              fieldPath: metadata.namespace\n        image: ghcr.io/fluxcd/kustomize-controller:v0.25.0\n        imagePullPolicy: IfNotPresent\n        livenessProbe:\n          httpGet:\n            path: /healthz\n            port: healthz\n        name: manager\n        ports:\n        - containerPort: 8080\n          name: http-prom\n          protocol: TCP\n        - containerPort: 9440\n          name: healthz\n          protocol: TCP\n        readinessProbe:\n          httpGet:\n            path: /readyz\n            port: healthz\n        resources:\n          limits:\n            cpu: 1000m\n            memory: 1Gi\n          requests:\n            cpu: 100m\n            memory: 64Mi\n        securityContext:\n          allowPrivilegeEscalation: false\n          capabilities:\n            drop:\n            - ALL\n          readOnlyRootFilesystem: true\n          runAsNonRoot: true\n          seccompProfile:\n            type: RuntimeDefault\n        volumeMounts:\n        - mountPath: /tmp\n          name: temp\n      nodeSelector:\n        kubernetes.io/os: linux\n      securityContext:\n        fsGroup: 1337\n      serviceAccountName: kustomize-controller\n      terminationGracePeriodSeconds: 60\n      volumes:\n      - emptyDir: {}\n        name: temp\n",
+            "yaml_incluster": "2826c2c4389823e3aaf89d714a101f295d74b565e99bd2a4d7436ce727817cea"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "apps/v1/deployment/flux-system/notification-controller",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "apps/v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/apps/v1/namespaces/flux-system/deployments/notification-controller",
+            "ignore_fields": null,
+            "kind": "Deployment",
+            "live_manifest_incluster": "6540cfaf3a1ae420ceb422d5fe5768c84e0297aae12d61c0204ad49d6c7f24c5",
+            "live_uid": "240b64d6-e55b-4e86-bdb7-cfd022661d13",
+            "name": "notification-controller",
+            "namespace": "flux-system",
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "240b64d6-e55b-4e86-bdb7-cfd022661d13",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n    control-plane: controller\n  name: notification-controller\n  namespace: flux-system\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: notification-controller\n  template:\n    metadata:\n      annotations:\n        prometheus.io/port: \"8080\"\n        prometheus.io/scrape: \"true\"\n      labels:\n        app: notification-controller\n    spec:\n      containers:\n      - args:\n        - --watch-all-namespaces=true\n        - --log-level=info\n        - --log-encoding=json\n        - --enable-leader-election\n        env:\n        - name: RUNTIME_NAMESPACE\n          valueFrom:\n            fieldRef:\n              fieldPath: metadata.namespace\n        image: ghcr.io/fluxcd/notification-controller:v0.23.5\n        imagePullPolicy: IfNotPresent\n        livenessProbe:\n          httpGet:\n            path: /healthz\n            port: healthz\n        name: manager\n        ports:\n        - containerPort: 9090\n          name: http\n          protocol: TCP\n        - containerPort: 9292\n          name: http-webhook\n          protocol: TCP\n        - containerPort: 8080\n          name: http-prom\n          protocol: TCP\n        - containerPort: 9440\n          name: healthz\n          protocol: TCP\n        readinessProbe:\n          httpGet:\n            path: /readyz\n            port: healthz\n        resources:\n          limits:\n            cpu: 1000m\n            memory: 1Gi\n          requests:\n            cpu: 100m\n            memory: 64Mi\n        securityContext:\n          allowPrivilegeEscalation: false\n          capabilities:\n            drop:\n            - ALL\n          readOnlyRootFilesystem: true\n          runAsNonRoot: true\n          seccompProfile:\n            type: RuntimeDefault\n        volumeMounts:\n        - mountPath: /tmp\n          name: temp\n      nodeSelector:\n        kubernetes.io/os: linux\n      securityContext:\n        fsGroup: 1337\n      serviceAccountName: notification-controller\n      terminationGracePeriodSeconds: 10\n      volumes:\n      - emptyDir: {}\n        name: temp",
+            "yaml_body_parsed": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n    control-plane: controller\n  name: notification-controller\n  namespace: flux-system\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: notification-controller\n  template:\n    metadata:\n      annotations:\n        prometheus.io/port: \"8080\"\n        prometheus.io/scrape: \"true\"\n      labels:\n        app: notification-controller\n    spec:\n      containers:\n      - args:\n        - --watch-all-namespaces=true\n        - --log-level=info\n        - --log-encoding=json\n        - --enable-leader-election\n        env:\n        - name: RUNTIME_NAMESPACE\n          valueFrom:\n            fieldRef:\n              fieldPath: metadata.namespace\n        image: ghcr.io/fluxcd/notification-controller:v0.23.5\n        imagePullPolicy: IfNotPresent\n        livenessProbe:\n          httpGet:\n            path: /healthz\n            port: healthz\n        name: manager\n        ports:\n        - containerPort: 9090\n          name: http\n          protocol: TCP\n        - containerPort: 9292\n          name: http-webhook\n          protocol: TCP\n        - containerPort: 8080\n          name: http-prom\n          protocol: TCP\n        - containerPort: 9440\n          name: healthz\n          protocol: TCP\n        readinessProbe:\n          httpGet:\n            path: /readyz\n            port: healthz\n        resources:\n          limits:\n            cpu: 1000m\n            memory: 1Gi\n          requests:\n            cpu: 100m\n            memory: 64Mi\n        securityContext:\n          allowPrivilegeEscalation: false\n          capabilities:\n            drop:\n            - ALL\n          readOnlyRootFilesystem: true\n          runAsNonRoot: true\n          seccompProfile:\n            type: RuntimeDefault\n        volumeMounts:\n        - mountPath: /tmp\n          name: temp\n      nodeSelector:\n        kubernetes.io/os: linux\n      securityContext:\n        fsGroup: 1337\n      serviceAccountName: notification-controller\n      terminationGracePeriodSeconds: 10\n      volumes:\n      - emptyDir: {}\n        name: temp\n",
+            "yaml_incluster": "6540cfaf3a1ae420ceb422d5fe5768c84e0297aae12d61c0204ad49d6c7f24c5"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "apps/v1/deployment/flux-system/source-controller",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "apps/v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/apps/v1/namespaces/flux-system/deployments/source-controller",
+            "ignore_fields": null,
+            "kind": "Deployment",
+            "live_manifest_incluster": "e1aba2209a36f10008a7a3ad79fcfbe50d58900fcb41060ab652fcf6364d6b7f",
+            "live_uid": "f06006e9-a0d5-492b-bedc-76bd68b508e6",
+            "name": "source-controller",
+            "namespace": "flux-system",
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "f06006e9-a0d5-492b-bedc-76bd68b508e6",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n    control-plane: controller\n  name: source-controller\n  namespace: flux-system\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: source-controller\n  strategy:\n    type: Recreate\n  template:\n    metadata:\n      annotations:\n        prometheus.io/port: \"8080\"\n        prometheus.io/scrape: \"true\"\n      labels:\n        app: source-controller\n    spec:\n      containers:\n      - args:\n        - --events-addr=http://notification-controller.flux-system.svc.cluster.local./\n        - --watch-all-namespaces=true\n        - --log-level=info\n        - --log-encoding=json\n        - --enable-leader-election\n        - --storage-path=/data\n        - --storage-adv-addr=source-controller.$(RUNTIME_NAMESPACE).svc.cluster.local.\n        env:\n        - name: RUNTIME_NAMESPACE\n          valueFrom:\n            fieldRef:\n              fieldPath: metadata.namespace\n        image: ghcr.io/fluxcd/source-controller:v0.24.4\n        imagePullPolicy: IfNotPresent\n        livenessProbe:\n          httpGet:\n            path: /healthz\n            port: healthz\n        name: manager\n        ports:\n        - containerPort: 9090\n          name: http\n          protocol: TCP\n        - containerPort: 8080\n          name: http-prom\n          protocol: TCP\n        - containerPort: 9440\n          name: healthz\n          protocol: TCP\n        readinessProbe:\n          httpGet:\n            path: /\n            port: http\n        resources:\n          limits:\n            cpu: 1000m\n            memory: 1Gi\n          requests:\n            cpu: 50m\n            memory: 64Mi\n        securityContext:\n          allowPrivilegeEscalation: false\n          capabilities:\n            drop:\n            - ALL\n          readOnlyRootFilesystem: true\n          runAsNonRoot: true\n          seccompProfile:\n            type: RuntimeDefault\n        volumeMounts:\n        - mountPath: /data\n          name: data\n        - mountPath: /tmp\n          name: tmp\n      nodeSelector:\n        kubernetes.io/os: linux\n      securityContext:\n        fsGroup: 1337\n      serviceAccountName: source-controller\n      terminationGracePeriodSeconds: 10\n      volumes:\n      - emptyDir: {}\n        name: data\n      - emptyDir: {}\n        name: tmp",
+            "yaml_body_parsed": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n    control-plane: controller\n  name: source-controller\n  namespace: flux-system\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: source-controller\n  strategy:\n    type: Recreate\n  template:\n    metadata:\n      annotations:\n        prometheus.io/port: \"8080\"\n        prometheus.io/scrape: \"true\"\n      labels:\n        app: source-controller\n    spec:\n      containers:\n      - args:\n        - --events-addr=http://notification-controller.flux-system.svc.cluster.local./\n        - --watch-all-namespaces=true\n        - --log-level=info\n        - --log-encoding=json\n        - --enable-leader-election\n        - --storage-path=/data\n        - --storage-adv-addr=source-controller.$(RUNTIME_NAMESPACE).svc.cluster.local.\n        env:\n        - name: RUNTIME_NAMESPACE\n          valueFrom:\n            fieldRef:\n              fieldPath: metadata.namespace\n        image: ghcr.io/fluxcd/source-controller:v0.24.4\n        imagePullPolicy: IfNotPresent\n        livenessProbe:\n          httpGet:\n            path: /healthz\n            port: healthz\n        name: manager\n        ports:\n        - containerPort: 9090\n          name: http\n          protocol: TCP\n        - containerPort: 8080\n          name: http-prom\n          protocol: TCP\n        - containerPort: 9440\n          name: healthz\n          protocol: TCP\n        readinessProbe:\n          httpGet:\n            path: /\n            port: http\n        resources:\n          limits:\n            cpu: 1000m\n            memory: 1Gi\n          requests:\n            cpu: 50m\n            memory: 64Mi\n        securityContext:\n          allowPrivilegeEscalation: false\n          capabilities:\n            drop:\n            - ALL\n          readOnlyRootFilesystem: true\n          runAsNonRoot: true\n          seccompProfile:\n            type: RuntimeDefault\n        volumeMounts:\n        - mountPath: /data\n          name: data\n        - mountPath: /tmp\n          name: tmp\n      nodeSelector:\n        kubernetes.io/os: linux\n      securityContext:\n        fsGroup: 1337\n      serviceAccountName: source-controller\n      terminationGracePeriodSeconds: 10\n      volumes:\n      - emptyDir: {}\n        name: data\n      - emptyDir: {}\n        name: tmp\n",
+            "yaml_incluster": "e1aba2209a36f10008a7a3ad79fcfbe50d58900fcb41060ab652fcf6364d6b7f"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "rbac.authorization.k8s.io/v1/clusterrole/crd-controller-flux-system",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "rbac.authorization.k8s.io/v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/rbac.authorization.k8s.io/v1/clusterroles/crd-controller-flux-system",
+            "ignore_fields": null,
+            "kind": "ClusterRole",
+            "live_manifest_incluster": "64b8d95fdeb8cce691e46833d902ac7fa67f9f19c375337869ae6f31be108d3f",
+            "live_uid": "9553a86a-f030-42ef-b755-d565579553ea",
+            "name": "crd-controller-flux-system",
+            "namespace": null,
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "9553a86a-f030-42ef-b755-d565579553ea",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: crd-controller-flux-system\nrules:\n- apiGroups:\n  - source.toolkit.fluxcd.io\n  resources:\n  - '*'\n  verbs:\n  - '*'\n- apiGroups:\n  - kustomize.toolkit.fluxcd.io\n  resources:\n  - '*'\n  verbs:\n  - '*'\n- apiGroups:\n  - helm.toolkit.fluxcd.io\n  resources:\n  - '*'\n  verbs:\n  - '*'\n- apiGroups:\n  - notification.toolkit.fluxcd.io\n  resources:\n  - '*'\n  verbs:\n  - '*'\n- apiGroups:\n  - image.toolkit.fluxcd.io\n  resources:\n  - '*'\n  verbs:\n  - '*'\n- apiGroups:\n  - \"\"\n  resources:\n  - namespaces\n  - secrets\n  - configmaps\n  - serviceaccounts\n  verbs:\n  - get\n  - list\n  - watch\n- apiGroups:\n  - \"\"\n  resources:\n  - events\n  verbs:\n  - create\n  - patch\n- apiGroups:\n  - \"\"\n  resources:\n  - configmaps\n  verbs:\n  - get\n  - list\n  - watch\n  - create\n  - update\n  - patch\n  - delete\n- apiGroups:\n  - \"\"\n  resources:\n  - configmaps/status\n  verbs:\n  - get\n  - update\n  - patch\n- apiGroups:\n  - coordination.k8s.io\n  resources:\n  - leases\n  verbs:\n  - get\n  - list\n  - watch\n  - create\n  - update\n  - patch\n  - delete",
+            "yaml_body_parsed": "apiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: crd-controller-flux-system\nrules:\n- apiGroups:\n  - source.toolkit.fluxcd.io\n  resources:\n  - '*'\n  verbs:\n  - '*'\n- apiGroups:\n  - kustomize.toolkit.fluxcd.io\n  resources:\n  - '*'\n  verbs:\n  - '*'\n- apiGroups:\n  - helm.toolkit.fluxcd.io\n  resources:\n  - '*'\n  verbs:\n  - '*'\n- apiGroups:\n  - notification.toolkit.fluxcd.io\n  resources:\n  - '*'\n  verbs:\n  - '*'\n- apiGroups:\n  - image.toolkit.fluxcd.io\n  resources:\n  - '*'\n  verbs:\n  - '*'\n- apiGroups:\n  - \"\"\n  resources:\n  - namespaces\n  - secrets\n  - configmaps\n  - serviceaccounts\n  verbs:\n  - get\n  - list\n  - watch\n- apiGroups:\n  - \"\"\n  resources:\n  - events\n  verbs:\n  - create\n  - patch\n- apiGroups:\n  - \"\"\n  resources:\n  - configmaps\n  verbs:\n  - get\n  - list\n  - watch\n  - create\n  - update\n  - patch\n  - delete\n- apiGroups:\n  - \"\"\n  resources:\n  - configmaps/status\n  verbs:\n  - get\n  - update\n  - patch\n- apiGroups:\n  - coordination.k8s.io\n  resources:\n  - leases\n  verbs:\n  - get\n  - list\n  - watch\n  - create\n  - update\n  - patch\n  - delete\n",
+            "yaml_incluster": "64b8d95fdeb8cce691e46833d902ac7fa67f9f19c375337869ae6f31be108d3f"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "rbac.authorization.k8s.io/v1/clusterrolebinding/cluster-reconciler-flux-system",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "rbac.authorization.k8s.io/v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/rbac.authorization.k8s.io/v1/clusterrolebindings/cluster-reconciler-flux-system",
+            "ignore_fields": null,
+            "kind": "ClusterRoleBinding",
+            "live_manifest_incluster": "fa44b2d7b1a5e317ad48f668736b5159d880a294ce7d2ca22c2925e3b91234b4",
+            "live_uid": "c35a1397-1075-462f-bb1d-04aac5cead05",
+            "name": "cluster-reconciler-flux-system",
+            "namespace": null,
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "c35a1397-1075-462f-bb1d-04aac5cead05",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: cluster-reconciler-flux-system\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: ClusterRole\n  name: cluster-admin\nsubjects:\n- kind: ServiceAccount\n  name: kustomize-controller\n  namespace: flux-system\n- kind: ServiceAccount\n  name: helm-controller\n  namespace: flux-system",
+            "yaml_body_parsed": "apiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: cluster-reconciler-flux-system\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: ClusterRole\n  name: cluster-admin\nsubjects:\n- kind: ServiceAccount\n  name: kustomize-controller\n  namespace: flux-system\n- kind: ServiceAccount\n  name: helm-controller\n  namespace: flux-system\n",
+            "yaml_incluster": "fa44b2d7b1a5e317ad48f668736b5159d880a294ce7d2ca22c2925e3b91234b4"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "rbac.authorization.k8s.io/v1/clusterrolebinding/crd-controller-flux-system",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "rbac.authorization.k8s.io/v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/rbac.authorization.k8s.io/v1/clusterrolebindings/crd-controller-flux-system",
+            "ignore_fields": null,
+            "kind": "ClusterRoleBinding",
+            "live_manifest_incluster": "6b8c8c6696023b30737eaa9f108706734b7dfc05b2b67ecad04648aac622acd2",
+            "live_uid": "8b42a696-6eae-4c09-a3b7-7cc14b8aea13",
+            "name": "crd-controller-flux-system",
+            "namespace": null,
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "8b42a696-6eae-4c09-a3b7-7cc14b8aea13",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: crd-controller-flux-system\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: ClusterRole\n  name: crd-controller-flux-system\nsubjects:\n- kind: ServiceAccount\n  name: kustomize-controller\n  namespace: flux-system\n- kind: ServiceAccount\n  name: helm-controller\n  namespace: flux-system\n- kind: ServiceAccount\n  name: source-controller\n  namespace: flux-system\n- kind: ServiceAccount\n  name: notification-controller\n  namespace: flux-system\n- kind: ServiceAccount\n  name: image-reflector-controller\n  namespace: flux-system\n- kind: ServiceAccount\n  name: image-automation-controller\n  namespace: flux-system",
+            "yaml_body_parsed": "apiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: crd-controller-flux-system\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: ClusterRole\n  name: crd-controller-flux-system\nsubjects:\n- kind: ServiceAccount\n  name: kustomize-controller\n  namespace: flux-system\n- kind: ServiceAccount\n  name: helm-controller\n  namespace: flux-system\n- kind: ServiceAccount\n  name: source-controller\n  namespace: flux-system\n- kind: ServiceAccount\n  name: notification-controller\n  namespace: flux-system\n- kind: ServiceAccount\n  name: image-reflector-controller\n  namespace: flux-system\n- kind: ServiceAccount\n  name: image-automation-controller\n  namespace: flux-system\n",
+            "yaml_incluster": "6b8c8c6696023b30737eaa9f108706734b7dfc05b2b67ecad04648aac622acd2"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "v1/namespace/flux-system",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/api/v1/namespaces/flux-system",
+            "ignore_fields": null,
+            "kind": "Namespace",
+            "live_manifest_incluster": "36cd74a4c6ef912d14993e6713511346b84b91b559cdcaefa1987bc9820c3340",
+            "live_uid": "0e244da8-b9b0-4053-bf00-7bedb468e182",
+            "name": "flux-system",
+            "namespace": null,
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "0e244da8-b9b0-4053-bf00-7bedb468e182",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "---\n# This manifest was generated by flux. DO NOT EDIT.\n# Flux Version: latest\n# Components: source-controller,kustomize-controller,helm-controller,notification-controller\napiVersion: v1\nkind: Namespace\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n    pod-security.kubernetes.io/warn: restricted\n    pod-security.kubernetes.io/warn-version: latest\n  name: flux-system",
+            "yaml_body_parsed": "apiVersion: v1\nkind: Namespace\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n    pod-security.kubernetes.io/warn: restricted\n    pod-security.kubernetes.io/warn-version: latest\n  name: flux-system\n",
+            "yaml_incluster": "36cd74a4c6ef912d14993e6713511346b84b91b559cdcaefa1987bc9820c3340"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "v1/service/flux-system/notification-controller",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/api/v1/namespaces/flux-system/services/notification-controller",
+            "ignore_fields": null,
+            "kind": "Service",
+            "live_manifest_incluster": "2bed8e777b97150ef0f8eb7ce6e224b6d4518449b38f9f1dd1f799f187211e33",
+            "live_uid": "2977a59e-2fd1-4f92-a998-1d95f4a2d1ea",
+            "name": "notification-controller",
+            "namespace": "flux-system",
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "2977a59e-2fd1-4f92-a998-1d95f4a2d1ea",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: v1\nkind: Service\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n    control-plane: controller\n  name: notification-controller\n  namespace: flux-system\nspec:\n  ports:\n  - name: http\n    port: 80\n    protocol: TCP\n    targetPort: http\n  selector:\n    app: notification-controller\n  type: ClusterIP",
+            "yaml_body_parsed": "apiVersion: v1\nkind: Service\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n    control-plane: controller\n  name: notification-controller\n  namespace: flux-system\nspec:\n  ports:\n  - name: http\n    port: 80\n    protocol: TCP\n    targetPort: http\n  selector:\n    app: notification-controller\n  type: ClusterIP\n",
+            "yaml_incluster": "2bed8e777b97150ef0f8eb7ce6e224b6d4518449b38f9f1dd1f799f187211e33"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "v1/service/flux-system/source-controller",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/api/v1/namespaces/flux-system/services/source-controller",
+            "ignore_fields": null,
+            "kind": "Service",
+            "live_manifest_incluster": "d56847b2a9516b2994b8bef69ba399ef8afb109c538adbe59446204688e1eae3",
+            "live_uid": "72cd6273-2019-4e1f-868a-485931ba1855",
+            "name": "source-controller",
+            "namespace": "flux-system",
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "72cd6273-2019-4e1f-868a-485931ba1855",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: v1\nkind: Service\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n    control-plane: controller\n  name: source-controller\n  namespace: flux-system\nspec:\n  ports:\n  - name: http\n    port: 80\n    protocol: TCP\n    targetPort: http\n  selector:\n    app: source-controller\n  type: ClusterIP",
+            "yaml_body_parsed": "apiVersion: v1\nkind: Service\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n    control-plane: controller\n  name: source-controller\n  namespace: flux-system\nspec:\n  ports:\n  - name: http\n    port: 80\n    protocol: TCP\n    targetPort: http\n  selector:\n    app: source-controller\n  type: ClusterIP\n",
+            "yaml_incluster": "d56847b2a9516b2994b8bef69ba399ef8afb109c538adbe59446204688e1eae3"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "v1/service/flux-system/webhook-receiver",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/api/v1/namespaces/flux-system/services/webhook-receiver",
+            "ignore_fields": null,
+            "kind": "Service",
+            "live_manifest_incluster": "32478dcd63b2b822236c495158f3253df5ba5b88831fbeaa2b1198d7a0b472d7",
+            "live_uid": "02d74f76-90d5-4da6-90e8-2a51a51d278b",
+            "name": "webhook-receiver",
+            "namespace": "flux-system",
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "02d74f76-90d5-4da6-90e8-2a51a51d278b",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: v1\nkind: Service\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n    control-plane: controller\n  name: webhook-receiver\n  namespace: flux-system\nspec:\n  ports:\n  - name: http\n    port: 80\n    protocol: TCP\n    targetPort: http-webhook\n  selector:\n    app: notification-controller\n  type: ClusterIP",
+            "yaml_body_parsed": "apiVersion: v1\nkind: Service\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n    control-plane: controller\n  name: webhook-receiver\n  namespace: flux-system\nspec:\n  ports:\n  - name: http\n    port: 80\n    protocol: TCP\n    targetPort: http-webhook\n  selector:\n    app: notification-controller\n  type: ClusterIP\n",
+            "yaml_incluster": "32478dcd63b2b822236c495158f3253df5ba5b88831fbeaa2b1198d7a0b472d7"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "v1/serviceaccount/flux-system/helm-controller",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/api/v1/namespaces/flux-system/serviceaccounts/helm-controller",
+            "ignore_fields": null,
+            "kind": "ServiceAccount",
+            "live_manifest_incluster": "b2aad3f57dca6ad5856d63af0e01b5be04fd424032893aceb9b21bbc92c347a5",
+            "live_uid": "aa9711e9-e81e-439e-a807-abb2e2ab7cfe",
+            "name": "helm-controller",
+            "namespace": "flux-system",
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "aa9711e9-e81e-439e-a807-abb2e2ab7cfe",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: v1\nkind: ServiceAccount\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: helm-controller\n  namespace: flux-system",
+            "yaml_body_parsed": "apiVersion: v1\nkind: ServiceAccount\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: helm-controller\n  namespace: flux-system\n",
+            "yaml_incluster": "b2aad3f57dca6ad5856d63af0e01b5be04fd424032893aceb9b21bbc92c347a5"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "v1/serviceaccount/flux-system/kustomize-controller",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/api/v1/namespaces/flux-system/serviceaccounts/kustomize-controller",
+            "ignore_fields": null,
+            "kind": "ServiceAccount",
+            "live_manifest_incluster": "8a14f17da2d09e6c888837953b3962a88d06f405df66028ff154a94d4dfa0d09",
+            "live_uid": "c73c43a2-52f9-42df-bf2b-897016848dda",
+            "name": "kustomize-controller",
+            "namespace": "flux-system",
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "c73c43a2-52f9-42df-bf2b-897016848dda",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: v1\nkind: ServiceAccount\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: kustomize-controller\n  namespace: flux-system",
+            "yaml_body_parsed": "apiVersion: v1\nkind: ServiceAccount\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: kustomize-controller\n  namespace: flux-system\n",
+            "yaml_incluster": "8a14f17da2d09e6c888837953b3962a88d06f405df66028ff154a94d4dfa0d09"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "v1/serviceaccount/flux-system/notification-controller",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/api/v1/namespaces/flux-system/serviceaccounts/notification-controller",
+            "ignore_fields": null,
+            "kind": "ServiceAccount",
+            "live_manifest_incluster": "846badceb5abc1172a04ac98661eded224067c4084bf88be0eb70075af5a53d1",
+            "live_uid": "743f674e-2fa2-48d1-ae58-36a2354b44ba",
+            "name": "notification-controller",
+            "namespace": "flux-system",
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "743f674e-2fa2-48d1-ae58-36a2354b44ba",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: v1\nkind: ServiceAccount\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: notification-controller\n  namespace: flux-system",
+            "yaml_body_parsed": "apiVersion: v1\nkind: ServiceAccount\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: notification-controller\n  namespace: flux-system\n",
+            "yaml_incluster": "846badceb5abc1172a04ac98661eded224067c4084bf88be0eb70075af5a53d1"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "v1/serviceaccount/flux-system/source-controller",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "v1",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/api/v1/namespaces/flux-system/serviceaccounts/source-controller",
+            "ignore_fields": null,
+            "kind": "ServiceAccount",
+            "live_manifest_incluster": "1d5862fdb063737cfa82134235c3dec3144c1c11ac78041a3c187751b6c2ed76",
+            "live_uid": "2e6d3b1e-37e0-4d53-83a4-65721bef5cbb",
+            "name": "source-controller",
+            "namespace": "flux-system",
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "2e6d3b1e-37e0-4d53-83a4-65721bef5cbb",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: v1\nkind: ServiceAccount\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: source-controller\n  namespace: flux-system",
+            "yaml_body_parsed": "apiVersion: v1\nkind: ServiceAccount\nmetadata:\n  labels:\n    app.kubernetes.io/instance: flux-system\n    app.kubernetes.io/part-of: flux\n    app.kubernetes.io/version: latest\n  name: source-controller\n  namespace: flux-system\n",
+            "yaml_incluster": "1d5862fdb063737cfa82134235c3dec3144c1c11ac78041a3c187751b6c2ed76"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        }
+      ]
     },
     {
       "module": "module.flux",
       "mode": "managed",
       "type": "kubectl_manifest",
       "name": "sync",
-      "provider": "provider[\"registry.terraform.io/gavinbunney/kubectl\"]",
-      "instances": []
+      "provider": "module.flux.provider[\"registry.terraform.io/gavinbunney/kubectl\"]",
+      "instances": [
+        {
+          "index_key": "kustomize.toolkit.fluxcd.io/v1beta2/kustomization/flux-system/flux-system",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "kustomize.toolkit.fluxcd.io/v1beta2",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/kustomize.toolkit.fluxcd.io/v1beta2/namespaces/flux-system/kustomizations/flux-system",
+            "ignore_fields": null,
+            "kind": "Kustomization",
+            "live_manifest_incluster": "76983d95c6d6af709777da0d4f83096cef10b2b6e625b0116db581080e962f87",
+            "live_uid": "29dd19f1-dc61-4ad1-97fb-e10e69359515",
+            "name": "flux-system",
+            "namespace": "flux-system",
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "29dd19f1-dc61-4ad1-97fb-e10e69359515",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: kustomize.toolkit.fluxcd.io/v1beta2\nkind: Kustomization\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 10m0s\n  path: ./clank\n  prune: true\n  sourceRef:\n    kind: GitRepository\n    name: flux-system",
+            "yaml_body_parsed": "apiVersion: kustomize.toolkit.fluxcd.io/v1beta2\nkind: Kustomization\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 10m0s\n  path: ./clank\n  prune: true\n  sourceRef:\n    kind: GitRepository\n    name: flux-system\n",
+            "yaml_incluster": "76983d95c6d6af709777da0d4f83096cef10b2b6e625b0116db581080e962f87"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_sync.main",
+            "module.flux.data.kubectl_file_documents.sync",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        },
+        {
+          "index_key": "source.toolkit.fluxcd.io/v1beta2/gitrepository/flux-system/flux-system",
+          "schema_version": 1,
+          "attributes": {
+            "api_version": "source.toolkit.fluxcd.io/v1beta2",
+            "apply_only": false,
+            "force_conflicts": false,
+            "force_new": false,
+            "id": "/apis/source.toolkit.fluxcd.io/v1beta2/namespaces/flux-system/gitrepositorys/flux-system",
+            "ignore_fields": null,
+            "kind": "GitRepository",
+            "live_manifest_incluster": "f159fca85740fe805d8ac4569899db00ab9cd9245350a7a56b689eafc490bedb",
+            "live_uid": "d2fea749-8f58-4ead-be65-bc2be53cb80e",
+            "name": "flux-system",
+            "namespace": "flux-system",
+            "override_namespace": null,
+            "sensitive_fields": null,
+            "server_side_apply": false,
+            "timeouts": null,
+            "uid": "d2fea749-8f58-4ead-be65-bc2be53cb80e",
+            "validate_schema": true,
+            "wait": null,
+            "wait_for_rollout": true,
+            "yaml_body": "apiVersion: source.toolkit.fluxcd.io/v1beta2\nkind: GitRepository\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 1m0s\n  ref:\n    branch: main\n  secretRef:\n    name: flux-system\n  url: ssh://git@git.front.kjuulh.io/clank/kubernetes-state.git",
+            "yaml_body_parsed": "apiVersion: source.toolkit.fluxcd.io/v1beta2\nkind: GitRepository\nmetadata:\n  name: flux-system\n  namespace: flux-system\nspec:\n  interval: 1m0s\n  ref:\n    branch: main\n  secretRef:\n    name: flux-system\n  url: ssh://git@git.front.kjuulh.io/clank/kubernetes-state.git\n",
+            "yaml_incluster": "f159fca85740fe805d8ac4569899db00ab9cd9245350a7a56b689eafc490bedb"
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.flux.data.flux_sync.main",
+            "module.flux.data.kubectl_file_documents.sync",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.flux",
+      "mode": "managed",
+      "type": "kubernetes_namespace",
+      "name": "flux_system",
+      "provider": "module.flux.provider[\"registry.terraform.io/hashicorp/kubernetes\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "flux-system",
+            "metadata": [
+              {
+                "annotations": {},
+                "generate_name": "",
+                "generation": 0,
+                "labels": {
+                  "app.kubernetes.io/instance": "flux-system",
+                  "app.kubernetes.io/part-of": "flux",
+                  "app.kubernetes.io/version": "latest"
+                },
+                "name": "flux-system",
+                "resource_version": "36003",
+                "uid": "0e244da8-b9b0-4053-bf00-7bedb468e182"
+              }
+            ],
+            "timeouts": null
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiZGVsZXRlIjozMDAwMDAwMDAwMDB9fQ=="
+        }
+      ]
+    },
+    {
+      "module": "module.flux",
+      "mode": "managed",
+      "type": "kubernetes_secret",
+      "name": "main",
+      "provider": "module.flux.provider[\"registry.terraform.io/hashicorp/kubernetes\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "binary_data": null,
+            "data": {
+              "identity": "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\nQyNTUxOQAAACBYZYPLAjLRZhUHfk4yTLmiQTDmdWPIgZTI+dGLgpY/GAAAAJgGvLdRBry3\nUQAAAAtzc2gtZWQyNTUxOQAAACBYZYPLAjLRZhUHfk4yTLmiQTDmdWPIgZTI+dGLgpY/GA\nAAAEBmqJkdSt8H6HIVzV6Na8ukBOj4Bywd970sQVPWAz8Ug1hlg8sCMtFmFQd+TjJMuaJB\nMOZ1Y8iBlMj50YuClj8YAAAAEWNvbnRhY3RAa2p1dWxoLmlvAQIDBA==\n-----END OPENSSH PRIVATE KEY-----\n",
+              "identity.pub": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFhlg8sCMtFmFQd+TjJMuaJBMOZ1Y8iBlMj50YuClj8Y contact@kjuulh.io\n",
+              "known_hosts": "git.front.kjuulh.io ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGJdO0Tw0e/Fa78g1Xszc4oKaOPbTwl7RTAaGQb0TrV8\ngit.front.kjuulh.io ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBO61xoa0ON2Y8rpIB6R9PFxg9HUxMym8Z5I4vYUC+/UnzaDx9YUEGo3Vig9wBo6Hc2lAp0BIwH/d5d6uBBEIj/Y=\n"
+            },
+            "id": "flux-system/flux-system",
+            "immutable": false,
+            "metadata": [
+              {
+                "annotations": {},
+                "generate_name": "",
+                "generation": 0,
+                "labels": {},
+                "name": "flux-system",
+                "namespace": "flux-system",
+                "resource_version": "40687",
+                "uid": "e4b26a74-1433-4a38-a126-63f7dec801f0"
+              }
+            ],
+            "type": "Opaque"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "module.flux.data.flux_install.main",
+            "module.flux.data.flux_sync.main",
+            "module.flux.data.kubectl_file_documents.apply",
+            "module.flux.kubectl_manifest.apply",
+            "module.flux.kubernetes_namespace.flux_system"
+          ]
+        }
+      ]
     },
     {
       "module": "module.kube-hetzner",
@@ -419,6 +1408,11 @@
             "network_zone": "eu-central",
             "service": null,
             "target": [
+              {
+                "label_selector": "",
+                "server_id": 20289430,
+                "type": "server"
+              },
               {
                 "label_selector": "",
                 "server_id": 20285807,
@@ -537,12 +1531,27 @@
               {
                 "label_selector": "",
                 "server": 20285811
+              },
+              {
+                "label_selector": "",
+                "server": 20289430
               }
             ],
             "id": "385507",
             "labels": {},
             "name": "clank",
             "rule": [
+              {
+                "description": "",
+                "destination_ips": [
+                  "0.0.0.0/0",
+                  "::/0"
+                ],
+                "direction": "out",
+                "port": "22",
+                "protocol": "tcp",
+                "source_ips": []
+              },
               {
                 "description": "",
                 "destination_ips": [
@@ -843,7 +1852,8 @@
             "servers": [
               20285807,
               20285809,
-              20285811
+              20285811,
+              20289430
             ],
             "type": "spread"
           },
@@ -1002,16 +2012,16 @@
           "private": "bnVsbA==",
           "dependencies": [
             "module.kube-hetzner.hcloud_firewall.k3s",
-            "module.kube-hetzner.hcloud_network.k3s",
             "module.kube-hetzner.hcloud_network_subnet.agent",
-            "module.kube-hetzner.hcloud_network_subnet.control_plane",
+            "module.kube-hetzner.hcloud_network.k3s",
+            "module.kube-hetzner.module.agents.random_string.server",
             "module.kube-hetzner.hcloud_placement_group.agent",
             "module.kube-hetzner.hcloud_placement_group.control_plane",
             "module.kube-hetzner.hcloud_ssh_key.k3s",
             "module.kube-hetzner.module.agents.data.cloudinit_config.config",
             "module.kube-hetzner.module.agents.hcloud_server.server",
             "module.kube-hetzner.module.agents.hcloud_server_network.server",
-            "module.kube-hetzner.module.agents.random_string.server",
+            "module.kube-hetzner.hcloud_network_subnet.control_plane",
             "module.kube-hetzner.module.control_planes.data.cloudinit_config.config",
             "module.kube-hetzner.module.control_planes.hcloud_server.server",
             "module.kube-hetzner.module.control_planes.hcloud_server_network.server",
@@ -1081,6 +2091,37 @@
             "module.kube-hetzner.null_resource.first_control_plane",
             "module.kube-hetzner.random_password.k3s_token"
           ]
+        },
+        {
+          "index_key": "2-1-storage1",
+          "schema_version": 0,
+          "attributes": {
+            "id": "8807962960687335091",
+            "triggers": {
+              "agent_id": "20289430"
+            }
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "module.kube-hetzner.hcloud_firewall.k3s",
+            "module.kube-hetzner.hcloud_network_subnet.agent",
+            "module.kube-hetzner.hcloud_network.k3s",
+            "module.kube-hetzner.hcloud_network_subnet.control_plane",
+            "module.kube-hetzner.hcloud_placement_group.agent",
+            "module.kube-hetzner.hcloud_placement_group.control_plane",
+            "module.kube-hetzner.hcloud_ssh_key.k3s",
+            "module.kube-hetzner.module.agents.data.cloudinit_config.config",
+            "module.kube-hetzner.module.agents.hcloud_server.server",
+            "module.kube-hetzner.module.agents.hcloud_server_network.server",
+            "module.kube-hetzner.module.agents.random_string.server",
+            "module.kube-hetzner.module.control_planes.data.cloudinit_config.config",
+            "module.kube-hetzner.module.control_planes.hcloud_server.server",
+            "module.kube-hetzner.module.control_planes.hcloud_server_network.server",
+            "module.kube-hetzner.module.control_planes.random_string.server",
+            "module.kube-hetzner.null_resource.first_control_plane",
+            "module.kube-hetzner.random_password.k3s_token"
+          ]
         }
       ]
     },
@@ -1765,6 +2806,159 @@
         }
       ]
     },
+    {
+      "module": "module.kube-hetzner.module.agents[\"2-1-storage1\"]",
+      "mode": "data",
+      "type": "cloudinit_config",
+      "name": "config",
+      "provider": "provider[\"registry.terraform.io/hashicorp/cloudinit\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "base64_encode": true,
+            "boundary": "MIMEBOUNDARY",
+            "gzip": true,
+            "id": "4262392169",
+            "part": [
+              {
+                "content": "#cloud-config\n\nwrite_files:\n\n# Configure the private network interface\n- content: |\n    BOOTPROTO='dhcp'\n    STARTMODE='auto'\n  path: /etc/sysconfig/network/ifcfg-eth1\n\n# Disable ssh password authentication\n- content: |\n    PasswordAuthentication no\n    X11Forwarding no\n    MaxAuthTries 2\n    AllowTcpForwarding no\n    AllowAgentForwarding no\n    AuthorizedKeysFile .ssh/authorized_keys\n  path: /etc/ssh/sshd_config.d/kube-hetzner.conf\n\n# Set reboot method as \"kured\"\n- content: |\n    REBOOT_METHOD=kured\n  path: /etc/transactional-update.conf\n\n# Create Rancher repo config\n- content: |\n    [rancher-k3s-common-stable]\n    name=Rancher K3s Common (stable)\n    baseurl=https://rpm.rancher.io/k3s/stable/common/microos/noarch\n    enabled=1\n    gpgcheck=1\n    repo_gpgcheck=0\n    gpgkey=https://rpm.rancher.io/public.key\n  path: /etc/zypp/repos.d/rancher-k3s-common.repo\n\n# Add ssh authorized keys\nssh_authorized_keys:\n  - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOmlyNDEGxQxnXOLGMn80DwjPt+CqCy17UaW9MSBphOy contact@kjuulh.io\n\n# Resize /var, not /, as that's the last partition in MicroOS image.\ngrowpart:\n    devices: [\"/var\"]\n\n# Make sure the hostname is set correctly\nhostname: clank-storage1-cgr\npreserve_hostname: true\n\nruncmd:\n\n# As above, make sure the hostname is not reset\n- [sed, '-i', 's/NETCONFIG_NIS_SETDOMAINNAME=\"yes\"/NETCONFIG_NIS_SETDOMAINNAME=\"no\"/g', /etc/sysconfig/network/config]\n- [sed, '-i', 's/DHCLIENT_SET_HOSTNAME=\"yes\"/DHCLIENT_SET_HOSTNAME=\"no\"/g', /etc/sysconfig/network/dhcp]\n\n# We set Cloudflare DNS servers, followed by Google as a backup\n- [sed, '-i', 's/NETCONFIG_DNS_STATIC_SERVERS=\"\"/NETCONFIG_DNS_STATIC_SERVERS=\"1.1.1.1 1.0.0.1 8.8.8.8\"/g', /etc/sysconfig/network/config]\n\n# Bounds the amount of logs that can survive on the system\n- [sed, '-i', 's/#SystemMaxUse=/SystemMaxUse=3G/g', /etc/systemd/journald.conf]\n- [sed, '-i', 's/#MaxRetentionSec=/MaxRetentionSec=1week/g', /etc/systemd/journald.conf]\n\n# Reduces the default number of snapshots from 2-10 number limit, to 4 and from 4-10 number limit important, to 2\n- [sed, '-i', 's/NUMBER_LIMIT=\"2-10\"/NUMBER_LIMIT=\"4\"/g', /etc/snapper/configs/root]\n- [sed, '-i', 's/NUMBER_LIMIT_IMPORTANT=\"4-10\"/NUMBER_LIMIT_IMPORTANT=\"3\"/g', /etc/snapper/configs/root]\n\n# Disables unneeded services\n- [systemctl, disable, '--now', 'rebootmgr.service']\n",
+                "content_type": "text/cloud-config",
+                "filename": "init.cfg",
+                "merge_type": ""
+              }
+            ],
+            "rendered": "H4sIAAAAAAAA/4xWX2/bPhJ8F5DvsFAefIezpDhp0daFgVNsNzVaWTlbaXtXBAZNriXWEqkjqTgK7sMfSCXNHyfND4YfuDueWc6uVxpLYVCYIGtrHELVlIbXRJmo4tfIPsJaNoIR1Y78ZJZMT9OL+SRe/Nv37Cn4hkpzKYYwCI8OvAMvCB6CDrw77gnXtdTcOCwxhtCiQmE+woaXKEiFI58LbkK6yf37X2WKCL1BFUwFlYyLfAjv1tw8ALiSDV6biJayYQGVYsPzAy/hFe4Vd/gQ43k7xQ2ubAF66HmHMHbxRiGYAqFW/IoYBIFmJ9UWuDCoNoSiFwDt5IfwPw8A4DRNs/NFmqWjHito3XPBZRYvsiSdTEc90hhpgzUxxRAiNDTSre7KiG75I76hmzxAUwxsLROuybpE0LqAmmi9k4oBaUyBwnBKrI/7dZzfAuNHOBDSZX8MBp+k2hFljbwLJuTaojPFUcOxC8VlKXcZrffBLhPnKMwzucYUUvEbZF+w1Z94iRBqXUTkd3y1xVY/cUEX9stWnRchi7bNGoMCzY1AFdqoNWOJBhSupTRQoSkkA6LB3zYKmb/vwmJq+7FKptnndDJyqMeqxk4VodYbUgZNzYjB31pjhbbrCyJogQoU1hJuB2ZP6afqUMH2RAdUVpUUgTa2b5cu7+b6junLiYaxw8DfOtDfHWhNNDaqHBXG1HoYRaquwlvekMtoe6KjDh51ClHFqZJSR0ISRQvHgcIC2GjgTnmd0wLp9vZor7D6HTu6g2yxfUmzbtYlp+EW28fG3bR1HVk6HbJo/+6hTVkPY8bc4N73HlzvtS5WT+Zh6AEEFhwgO377dvAB4jiOxyfzGzIelP+ZzAbzbPrWxmZpVbbzyfTs+l/X4kf69SwR748mu1/n5h/j/47bwbsL8v1Dsjyti7R1jSLU/HP7q2nKIuSurAVqfoMQXRHVByENRH07SKYgpqfdf74k2oDdfW5RAReQWLPTJfCK5Bh6uZI7mx86FxlecYp6CD99S+pfWpWEbBH03RYppDZ2DIBr0GiASqWQmrL17jJDoCUR20AbqUiOg4DmyqsValRXuLpHGdWg56lG0Iq5dRVrIGt5hX2oXpS0t7RUxgvgp0bWh17Ae33o6Wg+zcbp/NPsbDWfLVfLaTZJk3g2n8fJdOS3qP0/I4T0o7zXf2mbdcfLfdnJ5/HX2XSeWb7V53SZPRB8IfeKlF25zvnv6Cwe2yW/KYlCmMyX4HxUug8badcXMli3cCZlXqLtPoE1odum/pNBk/lytczibDZeLaeLb9PFcuT7r+QHofvYR094FA7gfeg+f8k07xBO7UO3G0pSyUYYkBsoZd6NK1AibMOv+BWCFA6mW22w2r/G4dIlEnJ9oXEUPTqdnD0qx2DFol+yUYKUzG3EZxp4mJDrBdo1yKVYIh1FTwODHeL2VWL3h2QNxe6WDDekKQ2IplqjsrfVgtS6kEbDRskKjoPB0V225BU3fTAS3gARrAO8eQoAXtVSGSI66PEzLb5ITqeL1ddZMstGvlXwn8TePGyYIHWN6rZNOlJSmmcMekiwmiXn6SKL55Zqj/5h9uRVofu3Ag2NEIgMmZtuu4NcGc5oaso+sA5oqwqE3NnCugdolavw9je9y733tSA48P4fAAD//909lR4OCgAA"
+          },
+          "sensitive_attributes": []
+        }
+      ]
+    },
+    {
+      "module": "module.kube-hetzner.module.agents[\"2-1-storage1\"]",
+      "mode": "managed",
+      "type": "hcloud_server",
+      "name": "server",
+      "provider": "module.kube-hetzner.provider[\"registry.terraform.io/hetznercloud/hcloud\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "backup_window": "",
+            "backups": false,
+            "datacenter": "fsn1-dc14",
+            "delete_protection": false,
+            "firewall_ids": [
+              385507
+            ],
+            "id": "20289430",
+            "ignore_remote_firewall_ids": false,
+            "image": "ubuntu-20.04",
+            "ipv4_address": "49.12.247.85",
+            "ipv6_address": "2a01:4f8:c012:d246::1",
+            "ipv6_network": "2a01:4f8:c012:d246::/64",
+            "iso": null,
+            "keep_disk": false,
+            "labels": {
+              "engine": "k3s",
+              "provisioner": "terraform"
+            },
+            "location": "fsn1",
+            "name": "clank-storage1-cgr",
+            "network": [],
+            "placement_group_id": 41238,
+            "rebuild_protection": false,
+            "rescue": "linux64",
+            "server_type": "cpx11",
+            "ssh_keys": [
+              "6372775"
+            ],
+            "status": "running",
+            "timeouts": null,
+            "user_data": "1yw8VGJRSEcjXrZpwCMw7s5ae8A="
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo1NDAwMDAwMDAwMDAwfX0=",
+          "dependencies": [
+            "module.kube-hetzner.hcloud_firewall.k3s",
+            "module.kube-hetzner.hcloud_network.k3s",
+            "module.kube-hetzner.hcloud_network_subnet.agent",
+            "module.kube-hetzner.hcloud_placement_group.agent",
+            "module.kube-hetzner.hcloud_ssh_key.k3s",
+            "module.kube-hetzner.module.agents.data.cloudinit_config.config",
+            "module.kube-hetzner.module.agents.random_string.server"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.kube-hetzner.module.agents[\"2-1-storage1\"]",
+      "mode": "managed",
+      "type": "hcloud_server_network",
+      "name": "server",
+      "provider": "module.kube-hetzner.provider[\"registry.terraform.io/hetznercloud/hcloud\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "alias_ips": [],
+            "id": "20289430-1628275",
+            "ip": "10.2.0.102",
+            "mac_address": "86:00:00:0f:27:a2",
+            "network_id": null,
+            "server_id": 20289430,
+            "subnet_id": "1628275-10.2.0.0/16"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "module.kube-hetzner.hcloud_firewall.k3s",
+            "module.kube-hetzner.hcloud_network.k3s",
+            "module.kube-hetzner.hcloud_network_subnet.agent",
+            "module.kube-hetzner.hcloud_placement_group.agent",
+            "module.kube-hetzner.hcloud_ssh_key.k3s",
+            "module.kube-hetzner.module.agents.data.cloudinit_config.config",
+            "module.kube-hetzner.module.agents.hcloud_server.server",
+            "module.kube-hetzner.module.agents.random_string.server"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.kube-hetzner.module.agents[\"2-1-storage1\"]",
+      "mode": "managed",
+      "type": "random_string",
+      "name": "server",
+      "provider": "provider[\"registry.terraform.io/hashicorp/random\"]",
+      "instances": [
+        {
+          "schema_version": 1,
+          "attributes": {
+            "id": "cgr",
+            "keepers": {
+              "name": "clank-storage1"
+            },
+            "length": 3,
+            "lower": true,
+            "min_lower": 0,
+            "min_numeric": 0,
+            "min_special": 0,
+            "min_upper": 0,
+            "number": false,
+            "override_special": null,
+            "result": "cgr",
+            "special": false,
+            "upper": false
+          },
+          "sensitive_attributes": [],
+          "private": "eyJzY2hlbWFfdmVyc2lvbiI6IjEifQ==",
+          "dependencies": [
+            "module.kube-hetzner.hcloud_network.k3s",
+            "module.kube-hetzner.hcloud_network_subnet.agent"
+          ]
+        }
+      ]
+    },
     {
       "module": "module.kube-hetzner.module.control_planes[\"0-0-control-plane-fsn1\"]",
       "mode": "data",