HI! I need to force pause the fleet git update process at a scheduled time. How can I schedule this operation? Thank you.

You may need to do it repo by repo (there's no global flag to pause all syncs AFAIK). If you go to your git repo object you can set the pause attribute to true. Example: apiVersion: fleet.cattle.io/v1alpha1 kind: GitRepo metadata: name: fleet-examples-single-cluster-helm annotations: {} # key: string creationTimestamp: '2022-10-02T215918Z' generation: 4 labels: {} # key: string namespace: fleet-default resourceVersion: '85196906' uid: a2cd4b38-fc81-474b-bbd1-0ac0a5d938ad fields: - fleet-examples-single-cluster-helm - https://github.com/juanbrny/fleet-examples.git - 8b480f244d0b4edb51cdbb048dc8aa5488e53f66 - 0/0 - null spec: branch: master insecureSkipTLSVerify: false paths: - /single-cluster/helm # - string paused: true repo: https://github.com/juanbrny/fleet-examples.git targets: - clusterSelector: matchExpressions: - key: provider.cattle.io operator: NotIn values: - harvester

May that work for you @numerous-lighter-90852?

Instead of using Kubernetes API to change that you can also use Rancher's REST API. Visit: https://myclusterfqdn/v1/fleet.cattle.io.gitrepos/fleet-default/mygit-repo-name and click on Edit to see an example request you can just use with curl to modify the paused attribute.

Thanks @quick-sandwich-76600, I test today this tips and I'll let you know.

Hi @quick-sandwich-76600. Thanks to your idea, I came up with this solution:

kubectl patch gitrepo/<repo name> -n fleet-local -p '{"spec": {"paused":false}}' --type merge

What do you think about it?

Yes, that should work great @numerous-lighter-90852 👍 At the end of the day, all Fleet and Rancher objects are just CRDs that can be easily modified/automated either through the standard Kubernetes way or through REST API (that's why I added the other example).

Thank you, it is clearer to me now. TOP! 😄

I really like Fleet; it is young, but it works well. I have joined the SUSE community.

👋 … how can you handle CRD’s in fleet? I have applications that is part helm chart and part CRD’s that are usually applied with kubectl BUT can I do that with fleet? ex. for appscode Stash

# Update catalog CRDs
$ kubectl apply -f <https://github.com/stashed/installer/raw/v2023.03.13/crds/stash-catalog-crds.yaml>

# Update the helm repositories
$ helm repo update

# Upgrade Stash Community operator chart
$ helm upgrade stash appscode/stash \
  --version v2023.03.13 \
  --namespace kube-system \
  --set features.community=true               \
  --set-file global.license=/path/to/the/license.txt

Hello everyone, I have an issue with Fleet and the Rancher CD Feature. Rancher does not seem to overwrite the version in targetCustomizations. Here is an example fleet.yaml:

namespace: example-namespace

helm:

releaseName: dfl

chart: "<oci://custom.registry.net/test/example>"

repo: ""

version: "1.0.0"

targetCustomizations:

- name: dev

helm:

chart: "<oci://custom.registry.net/test/example>"

version: "0.0.0-dev"

clusterName: cluster-dev

On our cluster "cluster-dev" it tries to deploy the Version 1.0.0 instead of 0.0.0-dev. Do you know what could be wrong? Thank you in advance.

Hi everyone! I have a weird issue regarding fleet + overlays (kustomize as well as simple manifests; rancher-2.7.1). I am trying to deploy an app, with a cluster-specific configMap:

targetCustomizations:

- name: cluster-0530

clusterName: cluster-0530

yaml:

overlays:

- cluster-0530

- name: cluster-0531

clusterName: cluster-0531

yaml:

overlays:

- cluster-0531

- name: cluster-0532

clusterName: cluster-0532

yaml:

overlays:

- cluster-0532

Now i put the configMap in each cluster-folder, but it will get deployed only on 1 cluster.. Even though

fleet test -t cluster-xyz .

shows the correct manifests.

I created an example - you can see the overlays, but only one of them gets deployed.. https://gitlab.com/strowi/fleet-test/-/tree/master/test

I am using rancher fleet. I wanna know if the fleet agents can communicate with teh fleet manager without needed the certificate (API_SERVER_CA_DATA) for the kube api server. I am essentialy looking to have some auth server in between

@flat-whale-67864 has left the channel

Hi, I have a problem with the rancher-logging-root-fluentbit daemon. Some pods start correctly, others have this error. Error: Error response from daemon: Duplicate mount point: /var/lib/docker/containers Any ideas to solve this error? Thanks.

I have a bundle that needs to be customized on multiple axes (region, environment), I think I'm missing something in how targetCustomization or how clusterSelector work to cover such a use case.

I noticed Fleet uses a custom resource named "Bundle" which is the same name as Trust Manager's custom resource for CA cert bundles. Is it a non-issue because they use different APIs or is it a collision that prevents installing both CRDs?

Hi, I'm seeing continuous restart on fleet-agent in one of our clusters. rancher 2.6.9. fleet-agent 0.5.0. I have a few other clusters in this rancher instance and they don't have the same problem. E0402 173731.896316 1 leaderelection.go:330] error retrieving resource lock cattle-fleet-system/fleet-agent-lock: Get "https://172.20.0.1:443/api/v1/namespaces/cattle-fleet-system/configmaps/fleet-agent-lock": context deadline exceeded I0402 173731.896359 1 leaderelection.go:283] failed to renew lease cattle-fleet-system/fleet-agent-lock: timed out waiting for the condition E0402 173731.896433 1 leaderelection.go:306] Failed to release lock: resource name may not be empty time="2023-04-02T173731Z" level=fatal msg="leaderelection lost for fleet-agent-lock"

Hey all, i have a secret containing the config for our AlertManager, i would like to customise the

routing_key

for each cluster using Fleet, is this possible? We're using a multi-cluster Kustomize structure https://github.com/rancher/fleet-examples/tree/master/multi-cluster/kustomize and here is an abridged version of our AM config:

apiVersion: v1
kind: Secret
metadata:
  name: cloudops-monitoring-alertmanager
  namespace: cattle-monitoring-system
type: Opaque
data:
  rancher_defaults.tmpl: >-
    [...]
stringData:
  alertmanager.yaml: |-
    global:
      slack_api_url: <https://hooks.slack.com/services/[...]>
      resolve_timeout: 5m
    route:
      group_by: [...]
      group_interval: 1m
      group_wait: 1s
      receiver: 'null'
      routes:
      - match:
          namespace: cattle-monitoring-system
          alertname: CPUThrottlingHigh
        receiver: 'null'
      - match_re:
          namespace: cattle-system|kube-system|fleet-system|cattle-monitoring-system|loki|cattle-dashboards|default
        receiver: cloudops
      - match:
          alertname: Watchdog
        receiver: 'null'
      - match:9
          alertname: KubeMemoryOvercommit
        receiver: 'null'
      - match:
          alertname: KubeCPUOvercommit
        receiver: 'null'
      [...]

    receivers:
    - name: "null"

    - name: cloudops
      pagerduty_configs:
        - routing_key: [...] <--- should be Kustomized
          send_resolved: true
          severity: '{{ if eq .CommonLabels.severity "critical" }}critical{{ else if eq .CommonLabels.severity "error" }}error{{ else if eq .CommonLabels.severity "warning" }}warning{{ else if eq .CommonLabels.severity "info" }}info{{ else }}critical{{ end }}'
          group: '{{ if .CommonLabels.cluster }}{{ .CommonLabels.cluster }}{{ end }}'

    [...]

Hi All, has anyone used Fleet with OPA Gatekeeper rules enabled on their downstream clusters? I'm running into an issue in which Fleet is getting blocked because of an OPA Gatekeeper rule which requires all namespaces to be in a project. Problem is that the namespace I am targeting already exists and is in a project. None the less, I get this error and none of namespaced resources show up:

Admission webhook "validation.gatekeeper.sh" denied the request: [ns-must-have-annotations] Every namespace must have a projectId

I am trying to use Fleet to deploy a helm chart with some values. I have had no success using defaultNamespace nor namespace in the fleet manifest, it all results in the same issue.

Is there any way to test which base and overlayed manifests fleet will apply? I have a repo structured identical to this example https://github.com/rancher/fleet-examples/tree/master/multi-cluster/kustomize but my overlays aren't working as if the

clusterSelector

in the

targetCustomizations

isn't matching with my clusters labels

Hi, I just tried to add the first repository in fleet and got the following error message which seems strange to me:

Git ls-remote -- <https://gitlab.com/XXXXXXX/YYYYYYY/.git/> refs/heads/main error: exit status 128, detail: fatal: could not read Username for '<https://gitlab.com>': terminal prompts disabled

I have double checked the credentials and even tried the git command succesfully in the gitjob pod which i suspected to be the one trying to do that

@future-night-17486 has left the channel

I’m having an issue with fleet reporting a resource as NotReady even though it is: 🧵

Hi, we are using private registry (Harbor) to pull the image for Continuous Delivery. We are seeing following exception message while doing this. We understand the issue that Harbor is expecting certificate from "Fleet-Default" namespace (Local) while pulling the container where local nodes dosent have our CA certs. So, how to resolve this problem ?

[Error] imageScan test-scan is not ready: Get "https://*****:443/v2/": x509: certificate signed by unknown authority; Get "https://*****:443/v2/": x509: certificate signed by unknown authority

Here is the error message.....