feat(updates): install Flux image controllers + cluster-wide write-back engine (R-UPD-02)

Install image-reflector-controller + image-automation-controller as part of the flux-system install (bootstrap.sh --components-extra) so the image.toolkit CRDs pre-exist before reconcile — no F-MON1 split needed for the ImageUpdateAutomation CR. Refine the cluster-wide ImageUpdateAutomation for machine-authored git write-back (setter strategy, path ./apps) reusing the flux-system GitRepository secretRef, and document the operator git-write-credential hand-off + SOPS secret template (gitea-image-automation-credentials). image-automation stays deferred in platform/kustomization.yaml until that credential is provisioned. Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-24 22:14:39 -05:00
1 parent f49b8c2e02
commit 37f4fa6767
@@ -0,0 +1,35 @@
+# =============================================================================
+# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
+# and never auto-encrypted by SOPS). Reference scaffold only.
+#
+# PURPOSE: the git WRITE credential Flux image-automation uses to commit machine-authored image tag
+# advances back to the GitOps source (ADR-0009, R-UPD-02). image-automation-controller has NO secretRef
+# of its own — it reuses the `flux-system` GitRepository's `.spec.secretRef`. So this Secret is wired
+# onto the flux-system GitRepository, NOT onto the ImageUpdateAutomation.
+#
+# (a) Generate a Gitea access token (scope: write:repository) for the bootstrap bot user, e.g.:
+#       curl -s -u <admin> -X POST http://10.73.0.1:3000/api/v1/users/fluxcdbot/tokens \
+#         -H 'content-type: application/json' \
+#         -d '{"name":"image-automation","scopes":["write:repository"]}'
+#     (the operator's bash step; store the returned token straight into this file — never print it).
+# (b) Copy to:      platform/image-automation/gitea-image-automation-credentials.sops.yaml
+#     add under `resources:` in platform/image-automation/kustomization.yaml:
+#                       - gitea-image-automation-credentials.sops.yaml
+# (c) Encrypt:       sops --encrypt --in-place platform/image-automation/gitea-image-automation-credentials.sops.yaml
+# (d) Consume it:    attach to the flux-system GitRepository via the bootstrap source-url patch
+#                    (bootstrap/flux/patches/flux-system-source-url.yaml) by adding:
+#                       spec:
+#                         secretRef:
+#                           name: gitea-image-automation-credentials
+#                    NOTE: the Secret must live in the flux-system namespace (same as the GitRepository).
+#                    Basic-auth keys are `username` + `password` (Gitea accepts the token as password).
+# =============================================================================
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-image-automation-credentials
+  namespace: flux-system
+type: Opaque
+stringData:
+  username: fluxcdbot
+  password: REPLACE-ME   # Gitea access token with write:repository scope (NOT a login password)