Flux git read-only mode

[stefanprodan]

When using Flux for infra bootstrap one may wish to point Flux to a read-only git repository that's being managed with Terraform or other tools.

Read-only mode implies that:

• When the read-only flag is set, Flux should check for Git read access instead of write access
• Flux should track the last applied commit without pushing a git tag to the repo
• The sync checkpoint should be stored in a ConfigMap or in a Custom Resource or as an annotation on the SSH key secret
• Flux registry scanning should be disabled (this can be accomplished with --registry-exclude-image=*)

Ref: microsoft/bedrock#50

[squaremo]

• Flux registry scanning should be disabled

I don't think this belongs with the other line items here. For one thing, scanning registries and reporting on the data therein is still being read-only! I don't see how it fits, even thematically, with a read-only mode (though I do understand it can be a desirable feature in itself).

[stefanprodan]

@squaremo I've updated the issue. Indeed there is no need to disable the registry scanning since we have a dedicated flag for it.

[squaremo]

Is this distinct from #1139?

[stefanprodan]

Ah I missed that, will close this it's a duplicate.