Flux CD
Hard
Security
How does notification-controller build the webhook URL path for a Receiver?
Select your answer:
Show answer and explanation
Answer: /hook/ followed by a hash of the token, Receiver name and namespace
Explanation
The path is /hook/ plus a SHA-256 digest of the token from the Receiver's Secret combined with its name and namespace, and it is shown in status.webhookPath. Rotating the token changes the URL, so update the webhook in your Git provider when you rotate it.
More hard Flux CD questions
- A HelmRelease's chartRef points at an OCIRepository holding a Helm chart. How should the OCIRepository's layerSelector handle the chart layer?
- How can you make Flux refuse an OCI artifact that wasn't signed by your CI pipeline?
- Which GitRepository setting makes Flux check that the tag it checks out was signed with a trusted PGP key?
- One kustomize-controller can't keep up with thousands of Kustomizations. How does Flux split the work?
- What does 'flux reconcile kustomization my-app' change on the object to trigger a reconciliation?
- A ConfigMap applied by a Flux Kustomization holds a shell script using ${HOME}, and postBuild substitution blanks it out. What stops that?