ksail workload gen receiver

Generate a Flux notification-controller Receiver, the webhook endpoint that asks Flux to reconcile the listed resources when an external system reports a change. --type=generic-oidc needs no Secret: callers present an OIDC ID token that the --oidc-validation expressions must accept.

Usage:
  ksail workload gen receiver [NAME] [flags]

Examples:
  # Generate a secret-less Receiver that GitHub Actions can call with its OIDC
  # token to reconcile a GitRepository, accepting only one organization's workflows
  ksail workload gen receiver github-actions \
    --type=generic-oidc \
    --oidc-issuer=https://token.actions.githubusercontent.com \
    --oidc-validation="claims.repository_owner == 'my-org'" \
    --oidc-validation-message="only my-org workflows may trigger a reconcile" \
    --resource=GitRepository/webapp

  # Reconcile an OCIRepository only when the calling workflow ran in its own repository
  ksail workload gen receiver releases \
    --type=generic-oidc \
    --oidc-issuer=https://token.actions.githubusercontent.com \
    --oidc-validation="claims.repository_owner == 'my-org'" \
    --resource="OCIRepository/webapp=res.metadata.annotations['repo'] == claims.repository"

  # Generate a GitHub webhook Receiver whose token is read from a Secret
  ksail workload gen receiver github-push \
    --type=github \
    --events=push \
    --secret-ref=webhook-token \
    --resource=GitRepository/webapp.apps

Flags:
      --events strings                        event types to handle, e.g. push for GitHub
  -n, --namespace string                      namespace for the Receiver (default "flux-system")
      --oidc-audience string                  expected token audience (generic-oidc; Flux defaults to notification-controller)
      --oidc-issuer string                    OIDC issuer URL whose ID tokens are accepted (generic-oidc)
      --oidc-validation stringArray           CEL expression over the token claims that must be true, repeatable (generic-oidc)
      --oidc-validation-message stringArray   message returned when the matching --oidc-validation is false, repeatable in the same order (default: a generic refusal that does not reveal the expression)
      --resource stringArray                  resource to reconcile, repeatable (Kind/name[.namespace][=<CEL filter>])
      --resource-filter string                CEL expression every resource must pass before it is reconciled
      --secret-ref string                     Secret holding the webhook token (every type except generic-oidc)
      --type string                           webhook sender type (generic, generic-hmac, generic-oidc, github, gitlab, bitbucket, harbor, dockerhub, quay, gcr, nexus, acr, cdevents)

Global Flags:
      --benchmark       Show per-activity benchmark output
      --config string   Path to config file (default: ksail.yaml found via directory traversal)
      --experimental    Enable experimental (unstable) commands and features