Implement automatic distribution updates from OCI artifacts

[stefanprodan]

This PR adds a new optional filed named .spec.distribution.artifact to the FluxInstance API. When specified, the operator will pull the artifact from the registry on a regular interval to determine the latest Flux version available including CVE patches and hotfixes.

Using this feature, CNCF Flux users can keep Flux up-to-date without having to update the operator every time there is a new Flux version available.

apiVersion: fluxcd.controlplane.io/v1
kind: FluxInstance
metadata:
  name: flux
  namespace: flux-system
spec:
  distribution:
    version: "2.x"
    registry: "ghcr.io/fluxcd"
    artifact: "oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests"

For enterprise customers, this feature allows for automated updates of CVE patches to fixed versions and semver ranges without having to update the operator.

apiVersion: fluxcd.controlplane.io/v1
kind: FluxInstance
metadata:
  name: flux
  namespace: flux-system
spec:
  distribution:
    version: "2.3.0"
    registry: "ghcr.io/controlplaneio-fluxcd/distroless"
    imagePullSecret: "flux-enterprise-auth"
    artifact: "oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests"

[souleb]

maybe should add a check here?

[stefanprodan]

-p will not create the dir if it exists.

[souleb]

can we name it maybe artifactURL?

[stefanprodan]

I did consider this but given that we use registry and not registryURL, for consistency I chose to not have the URL suffix.

[souleb]

If I got it correctly, at every reconciliation we fetch the manifests and don't store it locally. What do you think about storing the artifact and its manifest digest, at each reconciliation, we would first fetch the manifest and compare the digest with local version before attempting to fetch the blob?

[stefanprodan]

Yes we could have a similar storage & auth implementation as SC in a followup PR. I'm also considering using the layer caching I implemented in Timoni which is more close to how OverlayFS works in OCI registries.

[souleb]

LGTM!