Impossibile to use gpm module in environments with constrained Internet access

[lnovara]

I am not able to deploy the gpm module in an environment with constrained Internet access since we're pulling the Kustomize base directly from GitHub.

I know that it will lead to some duplications, but can we consider to just add the manifests to this repository as well instead of pulling the base from GitHub?

Thank you.

[angelbarrera92]

🤔 And how do you download the base OPA module?

[ralgozino]

I have the same doubt that @angelbarrera92 but if it helps maybe we could make GPM's repo furyctl-compatible so you could add it to your Furyfile, shouldn't be too much effort

[lnovara]

🤔 And how do you download the base OPA module?

The base OPA module is vendored through furyctl and committed to a git repo that than is pulled from a machine with access to both the repo and the cluster.

[angelbarrera92]

🤔 And how do you download the base OPA module?

The base OPA module is vendored through furyctl and committed to a git repo that than is pulled from a machine with access to both the repo and the cluster.

Understood. Now we have to think about how to solve this problem

[ralgozino]

Being that kustomize is dropping support for remote resources in v4. This issue will become more important, and not just a problem in internet-constrained environments.

Some options that I can think of are:

• Duplicate the yaml files as Luca suggested.
• Create a fury-kubernetes-apps repo where we could put the all yamls for this kind of "shared" apps manifests.
• Add support in furyctl to specify in the Furyfile the URL from where to download the base overriding the dynamic generated one -as we do for the version-, If the URL field is not set, used the dynamic one.

See also as reference:
fluxcd/flux2#918

Thoughts?