Repository navigation
Filter ignore-paths recursively through bases - #6087
Open
akashchamp wants to merge 1 commit into
Open
akashchamp wants to merge 1 commit into
akashchamp wants to merge 1 commit into
Conversation
fluxcd/pkg/kustomize only strips ignored entries from the kustomization.yaml it generates at the build root. Native Kustomize then reads any base or component straight off the filesystem, so a file matched by --ignore-paths still leaks into the build whenever it is only reachable through a referenced base or sub-directory. Wrap the filesys.FileSystem handed to kustomize.Build so that every kustomization file it reads, not just the root one, has its resources, components and crds entries filtered the same way. The ignore patterns are re-anchored to each file's own directory, so they keep matching bases outside the build root (e.g. referenced with ../../base). Signed-off-by: Akash Kumar <116457960+akashchamp@users.noreply.github.com> Assisted-by: Claude Code/claude-sonnet-5
akashchamp
force-pushed
the
fix-ignore-paths-nested-bases
branch
from
October 8, 2026 18:34
b0f3771 to
449fad0
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
flux build --ignore-pathsonly filters the kustomization.yaml generated at the build root. Files matched by the patterns still leak into the build when they are reachable only through a referenced base or component (e.g.overlay->../basecontainingsecret.enc.yaml).This wraps the
filesys.FileSystempassed tokustomize.Build(internal/build/ignorefs.go) so every kustomization file Kustomize reads has itsresources,componentsandcrdsentries filtered against the ignore patterns, anchored to that file's own directory. It only reads through the filesystem abstraction and is only active when--ignore-pathsis passed.Closes #6067
Tests: new
Test_ignoreFilterFS_filtersBaseResourcesininternal/build, plus CLI golden cases incmd/flux(build ignore nested base, on-disk and--in-memory-build).AI disclosure: this change was written with AI assistance (Claude Code / claude-sonnet-5), as recorded in the
Assisted-bytrailer of the commit.