Equivalent for --k8s-unsafe-exclude-resource in flux2

[Fabian-K]

Hi,

we are currently using flux v1 with garbage collection enabled. Because we have some CRDs that have many instances and at the same time should never be touched by flux we exclude them using --k8s-unsafe-exclude-resource to not run into https://github.com/fluxcd/flux/blob/master/docs/troubleshooting.md#flux-fails-with-an-error-log-similar-to-couldnt-get-resource-list-for-examplecomversion-the-server-is-currently-unable-to-handle-the-request

Is there an equivalent to this in flux2? I assume that the garbage collection still works in a way that it will iterate all instances of all CRDs and check for the annotations. I thought about using https://toolkit.fluxcd.io/components/kustomize/kustomization/#role-based-access-control but (I think) there is no simple way of expressing "you have access to all resources except A,B & C"

Thanks,
Fabian

[stefanprodan]

I assume that the garbage collection still works in a way that it will iterate all instances of all CRDs and check for the annotations.

The GC in Flux v2 is very different to v1. The GC no longer queries the Kubernetes API so there is no need for unsafe-exclude-resource.

[Fabian-K]

Cool, thanks for the quick answer!

Optional: Out of curiosity, du you have a (short) summary how GC works with v2? Du you separately keep track of created objects to compare that with the desired state to find out if they can be deleted?

[stefanprodan]

Here are the GC docs: https://toolkit.fluxcd.io/components/kustomize/kustomization/#garbage-collection

In v2 we use the status sub-resource to store the GC snapshot, that's composed of a map of group/version/kind/namespace.