feat(updates): install Flux image controllers + cluster-wide write-back engine (R-UPD-02)
Install image-reflector-controller + image-automation-controller as part of the flux-system install (bootstrap.sh --components-extra) so the image.toolkit CRDs pre-exist before reconcile — no F-MON1 split needed for the ImageUpdateAutomation CR. Refine the cluster-wide ImageUpdateAutomation for machine-authored git write-back (setter strategy, path ./apps) reusing the flux-system GitRepository secretRef, and document the operator git-write-credential hand-off + SOPS secret template (gitea-image-automation-credentials). image-automation stays deferred in platform/kustomization.yaml until that credential is provisioned. Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed
1 parent
f49b8c2e02
commit
37f4fa6767
4 files changed
+154
-33
No files matched your search
@@ -11,7 +11,17 @@
|
||||
# WHAT THIS DOES (Phase 1, bootstrap-source method — reconciles from the LOCAL repo, no remote
|
||||
# git host exists yet per spec docs/05 + CONTRIBUTING.md):
|
||||
#
|
||||
# 1. `flux install` — deploy the Flux controllers ONLY (source, kustomize, helm controllers).
|
||||
# 1. `flux install` — deploy the Flux controllers. Besides the default set (source, kustomize,
|
||||
# helm, notification) we ALSO install the two IMAGE controllers via
|
||||
# `--components-extra` (see FLUX_COMPONENTS_EXTRA below): image-reflector-
|
||||
# controller + image-automation-controller. These register the
|
||||
# image.toolkit.fluxcd.io CRDs (ImageRepository/ImagePolicy/ImageUpdateAutomation)
|
||||
# that Phase-4 hands-off updates need (ADR-0009, R-UPD-02). They are part of the
|
||||
# flux-system install exactly like the other 4 controllers — NOT a reconciled
|
||||
# HelmRelease — so their CRDs pre-exist before the first reconcile (this is why
|
||||
# platform/image-automation can carry the ImageUpdateAutomation CR without the
|
||||
# F-MON1 controllers/configs split: the CRD is present at bootstrap, like
|
||||
# GitRepository/Kustomization are). WS-UPDATE (T-4.5).
|
||||
# We do NOT use `flux bootstrap git` in Phase 1 because that command commits
|
||||
# and OWNS its own gotk-sync GitRepository+Kustomization named `flux-system`.
|
||||
# Our entrypoints are ALREADY authored in clusters/base (flux-system.yaml =
|
||||
@@ -42,6 +52,9 @@ set -euo pipefail
|
||||
FLUX_ENV_PATH="${FLUX_ENV_PATH:-clusters/dev}" # dev is the ONLY Phase-1 build target
|
||||
FLUX_NAMESPACE="${FLUX_NAMESPACE:-flux-system}"
|
||||
SOPS_SECRET_NAME="${SOPS_SECRET_NAME:-sops-age}"
|
||||
# The two Phase-4 image-automation controllers are installed alongside the default set so their CRDs
|
||||
# exist before reconcile (ADR-0009, R-UPD-02). Override to "" to build a cluster without them.
|
||||
FLUX_COMPONENTS_EXTRA="${FLUX_COMPONENTS_EXTRA:-image-reflector-controller,image-automation-controller}"
|
||||
|
||||
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
repo_root="$(git -C "${script_dir}" rev-parse --show-toplevel 2>/dev/null || cd "${script_dir}/../.." && pwd)"
|
||||
@@ -54,8 +67,16 @@ for bin in flux kubectl; do
|
||||
done
|
||||
|
||||
# --- 1. install Flux controllers ---------------------------------------------
|
||||
echo "==> [1/3] flux install (controllers only)"
|
||||
flux install --namespace="${FLUX_NAMESPACE}"
|
||||
# Default controllers + the image-reflector/image-automation pair (Phase-4 hands-off updates,
|
||||
# ADR-0009). `--components-extra` regenerates flux-system with all controllers and registers the
|
||||
# image.toolkit.fluxcd.io CRDs before any reconcile — so platform/image-automation's CR applies cleanly.
|
||||
if [ -n "${FLUX_COMPONENTS_EXTRA}" ]; then
|
||||
echo "==> [1/3] flux install (default controllers + extra: ${FLUX_COMPONENTS_EXTRA})"
|
||||
flux install --namespace="${FLUX_NAMESPACE}" --components-extra="${FLUX_COMPONENTS_EXTRA}"
|
||||
else
|
||||
echo "==> [1/3] flux install (default controllers only)"
|
||||
flux install --namespace="${FLUX_NAMESPACE}"
|
||||
fi
|
||||
|
||||
# --- 2. verify the out-of-band age key Secret exists -------------------------
|
||||
# We DO NOT create it here (it holds the private key). The operator installs it per
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
# =============================================================================
|
||||
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
|
||||
# and never auto-encrypted by SOPS). Reference scaffold only.
|
||||
#
|
||||
# PURPOSE: the git WRITE credential Flux image-automation uses to commit machine-authored image tag
|
||||
# advances back to the GitOps source (ADR-0009, R-UPD-02). image-automation-controller has NO secretRef
|
||||
# of its own — it reuses the `flux-system` GitRepository's `.spec.secretRef`. So this Secret is wired
|
||||
# onto the flux-system GitRepository, NOT onto the ImageUpdateAutomation.
|
||||
#
|
||||
# (a) Generate a Gitea access token (scope: write:repository) for the bootstrap bot user, e.g.:
|
||||
# curl -s -u <admin> -X POST http://10.73.0.1:3000/api/v1/users/fluxcdbot/tokens \
|
||||
# -H 'content-type: application/json' \
|
||||
# -d '{"name":"image-automation","scopes":["write:repository"]}'
|
||||
# (the operator's bash step; store the returned token straight into this file — never print it).
|
||||
# (b) Copy to: platform/image-automation/gitea-image-automation-credentials.sops.yaml
|
||||
# add under `resources:` in platform/image-automation/kustomization.yaml:
|
||||
# - gitea-image-automation-credentials.sops.yaml
|
||||
# (c) Encrypt: sops --encrypt --in-place platform/image-automation/gitea-image-automation-credentials.sops.yaml
|
||||
# (d) Consume it: attach to the flux-system GitRepository via the bootstrap source-url patch
|
||||
# (bootstrap/flux/patches/flux-system-source-url.yaml) by adding:
|
||||
# spec:
|
||||
# secretRef:
|
||||
# name: gitea-image-automation-credentials
|
||||
# NOTE: the Secret must live in the flux-system namespace (same as the GitRepository).
|
||||
# Basic-auth keys are `username` + `password` (Gitea accepts the token as password).
|
||||
# =============================================================================
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: gitea-image-automation-credentials
|
||||
namespace: flux-system
|
||||
type: Opaque
|
||||
stringData:
|
||||
username: fluxcdbot
|
||||
password: REPLACE-ME # Gitea access token with write:repository scope (NOT a login password)
|
||||
Reference in new issue
Block a user