CtrlK
BlogDocsLog inGet started
Tessl Logo

dirien/pulumi-skills

Pulumi infrastructure-as-code and Flux CD GitOps skills for Claude Code with ESC, OIDC, and cloud provider best practices.

97

Quality

97%

Does it follow best practices?

Impact

Pending

No eval scenarios have been run

SecuritybySnyk

Risky

Do not use without reviewing

Overview
Quality
Evals
Security
Files

artifacts-and-images.mdflux-cli/references/

OCI Artifact & Image Automation Commands

Table of Contents

  1. Push Artifact
  2. Pull Artifact
  3. Tag Artifact
  4. List Artifacts
  5. Diff Artifact
  6. Image Repository
  7. Image Policy
  8. Image Update Automation

Push Artifact

Create a tarball from a directory or file and push it to an OCI registry.

flux push artifact oci://<registry>/<name>:<tag> [flags]

Flags

FlagDescription
-f, --pathPath to directory or file to package (required)
--sourceSource URL (usually Git repo URL)
--revisionSource revision: <branch|tag>@sha1:<commit-sha>
-a, --annotationsCustom OCI annotations: key=value (repeatable)
--providerAuth provider: generic, aws, azure, gcp
--credsRegistry credentials: <username>[:<password>]
-o, --outputOutput format: json, yaml
--reproducibleEnsure reproducible digests
--ignore-pathsPaths to ignore (.gitignore format)
--insecure-registryAllow push without TLS
--debugShow underlying library logs

Examples

# Push manifests
flux push artifact oci://ghcr.io/org/my-app:v1.0.0 \
  --path=./deploy \
  --source=https://github.com/org/my-app \
  --revision=main@sha1:abc1234

# Push with annotations
flux push artifact oci://ghcr.io/org/my-app:v1.0.0 \
  --path=./deploy \
  --annotations="org.opencontainers.image.description=My App manifests"

# Push to ECR
flux push artifact oci://123456789.dkr.ecr.us-east-1.amazonaws.com/my-app:v1.0.0 \
  --path=./deploy \
  --provider=aws

Pull Artifact

Download an OCI artifact to a local directory.

flux pull artifact oci://<registry>/<name>:<tag> --output=<dir> [flags]

Examples

flux pull artifact oci://ghcr.io/org/my-app:v1.0.0 --output=./downloaded

Tag Artifact

Add a tag to an existing OCI artifact.

flux tag artifact oci://<registry>/<name>:<source-tag> --tag=<new-tag> [flags]

Examples

# Promote a version to latest
flux tag artifact oci://ghcr.io/org/my-app:v1.0.0 --tag=latest

# Promote to a staging tag
flux tag artifact oci://ghcr.io/org/my-app:v1.0.0 --tag=staging

List Artifacts

List all tags/versions of an OCI artifact.

flux list artifacts oci://<registry>/<name> [flags]

Examples

flux list artifacts oci://ghcr.io/org/my-app

Diff Artifact

Compare a local directory against an OCI artifact.

flux diff artifact oci://<registry>/<name>:<tag> --path=<local-dir> [flags]

Examples

flux diff artifact oci://ghcr.io/org/my-app:v1.0.0 --path=./deploy

Image Repository

Set up image scanning to detect new container image tags.

flux create image repository <name> [flags]

Key Flags

FlagDescription
--imageContainer image to scan: <registry>/<name> (required)
--scan-timeoutTimeout for image scanning
--secret-refSecret with registry credentials
--cert-secret-refSecret with TLS certificates
--providerAuth provider: generic, aws, azure, gcp
--intervalScan interval
--exportOutput YAML

Examples

# Scan Docker Hub image
flux create image repository my-app \
  --image=docker.io/org/my-app \
  --interval=5m

# Scan private registry
flux create image repository my-app \
  --image=ghcr.io/org/my-app \
  --secret-ref=ghcr-auth \
  --interval=5m

Image Policy

Define which image tags to track and select for updates.

flux create image policy <name> [flags]

Key Flags

FlagDescription
--image-refName of the ImageRepository to reference (required)
--select-semverSemver range to filter tags (e.g. >=1.0.0 <2.0.0)
--select-alphaAlphabetical ordering for tag selection
--select-numericNumeric ordering for tag selection
--filter-regexRegex to filter tags
--filter-extractRegex extraction for tag comparison
--intervalReconciliation interval
--exportOutput YAML

Examples

# Track semver tags
flux create image policy my-app \
  --image-ref=my-app \
  --select-semver=">=1.0.0"

# Track numeric tags
flux create image policy my-app \
  --image-ref=my-app \
  --select-numeric=asc \
  --filter-regex="^main-(?P<ts>[0-9]+)" \
  --filter-extract='$ts'

Image Update Automation

Automatically commit image tag updates back to Git.

flux create image update <name> [flags]

Key Flags

FlagDescription
--git-repo-refGitRepository source reference (required)
--git-repo-pathPath within the repo to update
--git-repo-namespaceNamespace of the GitRepository
--checkout-branchBranch to checkout
--push-branchBranch to push updates to
--author-nameGit author name for commits
--author-emailGit author email for commits
--commit-templateTemplate for commit messages
--intervalReconciliation interval
--exportOutput YAML

Examples

# Auto-update images in a repo
flux create image update my-update \
  --git-repo-ref=my-app \
  --git-repo-path=./deploy \
  --checkout-branch=main \
  --push-branch=main \
  --author-name=flux \
  --author-email=flux@example.com

# Push to a separate branch (for PRs)
flux create image update my-update \
  --git-repo-ref=my-app \
  --git-repo-path=./deploy \
  --checkout-branch=main \
  --push-branch=flux-image-updates \
  --author-name=flux

Querying Image Resources

# List all image automation objects
flux get images all [-A]

# By type
flux get images repository [-A]
flux get images policy [-A]
flux get images update [-A]

# Force reconciliation
flux reconcile image repository <name>
flux reconcile image policy <name>
flux reconcile image update <name>

# Suspend/resume
flux suspend image repository <name>
flux resume image repository <name>

flux-cli

references

artifacts-and-images.md

bootstrap.md

helmreleases.md

kustomizations.md

sources.md

SKILL.md

AGENTS.md

CLAUDE.md

README.md

tile.json