From d24a443c7d70b0cb27263646baedc869d0229251 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sat, 29 Aug 2026 23:19:20 -0500 Subject: [PATCH] chore(flux): migrate image-automation API v1beta2 -> v1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Migrate image.toolkit.fluxcd.io/v1beta2 -> /v1 for ImageRepository, ImagePolicy, and ImageUpdateAutomation ahead of the Flux v2.7+ upgrade (cluster-upgrade-plan §3.2). Flux v2.4 (current) already serves /v1, so migrating the manifests now is a safe no-op at runtime. - catalog/render.py: r_image_automation emits v1 for ImageRepository/ImagePolicy - platform/image-automation/{image-update-automation,per-service/pihole.example} - conformance L3 hands-off-update chainsaw applies v1 CRs - conformance L1 goldens re-rendered to match (apiVersion-only diff) No spec-field changes required: all spec fields used (image, interval, imageRepositoryRef, filterTags.pattern/extract, policy.semver.range, sourceRef, git.*, update.strategy/path) are unchanged in v1; the v1 messageTemplate already uses .Changed (not the removed .Updated). apps/ golden unaffected (canonical render uses --no-image-automation). Co-Authored-By: Claude Opus 4.8 --- catalog/render.py | 4 ++-- .../container-workload-render/golden/expected.yaml | 4 ++-- .../default-deny-baseline-render/golden/expected.yaml | 4 ++-- .../golden/egress-internet.expected.yaml | 4 ++-- .../egress-class-render/golden/egress-vpn.expected.yaml | 4 ++-- .../l3-fault-injection/hands-off-update/chainsaw-test.yaml | 6 +++--- platform/image-automation/image-update-automation.yaml | 2 +- platform/image-automation/per-service/pihole.example.yaml | 4 ++-- 8 files changed, 16 insertions(+), 16 deletions(-) diff --git a/catalog/render.py b/catalog/render.py index dee946b..67f3947 100644 --- a/catalog/render.py +++ b/catalog/render.py @@ -667,7 +667,7 @@ def r_image_automation(s: dict) -> list: upd = s["update"] interval = "1h0m0s" imagerepo = { - "apiVersion": "image.toolkit.fluxcd.io/v1beta2", + "apiVersion": "image.toolkit.fluxcd.io/v1", "kind": "ImageRepository", "metadata": {"name": s["name"], "namespace": s["name"]}, "spec": {"image": image, "interval": interval}, @@ -682,7 +682,7 @@ def r_image_automation(s: dict) -> list: else: policy_spec["policy"] = {"semver": {"range": ">=0.0.0"}} imagepolicy = { - "apiVersion": "image.toolkit.fluxcd.io/v1beta2", + "apiVersion": "image.toolkit.fluxcd.io/v1", "kind": "ImagePolicy", "metadata": { "name": s["name"], diff --git a/conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml b/conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml index 1e325bb..599971e 100644 --- a/conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml +++ b/conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml @@ -162,7 +162,7 @@ spec: interval: 30s --- # Flux ImageRepository (R-UPD) -apiVersion: image.toolkit.fluxcd.io/v1beta2 +apiVersion: image.toolkit.fluxcd.io/v1 kind: ImageRepository metadata: name: paas-demo @@ -172,7 +172,7 @@ spec: interval: 1h0m0s --- # Flux ImagePolicy (R-UPD) -apiVersion: image.toolkit.fluxcd.io/v1beta2 +apiVersion: image.toolkit.fluxcd.io/v1 kind: ImagePolicy metadata: name: paas-demo diff --git a/conformance/tests/l1-rendering/default-deny-baseline-render/golden/expected.yaml b/conformance/tests/l1-rendering/default-deny-baseline-render/golden/expected.yaml index 5d09699..37b31c5 100644 --- a/conformance/tests/l1-rendering/default-deny-baseline-render/golden/expected.yaml +++ b/conformance/tests/l1-rendering/default-deny-baseline-render/golden/expected.yaml @@ -93,7 +93,7 @@ spec: interval: 30s --- # Flux ImageRepository (R-UPD) -apiVersion: image.toolkit.fluxcd.io/v1beta2 +apiVersion: image.toolkit.fluxcd.io/v1 kind: ImageRepository metadata: name: baseline-demo @@ -103,7 +103,7 @@ spec: interval: 1h0m0s --- # Flux ImagePolicy (R-UPD) -apiVersion: image.toolkit.fluxcd.io/v1beta2 +apiVersion: image.toolkit.fluxcd.io/v1 kind: ImagePolicy metadata: name: baseline-demo diff --git a/conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml b/conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml index e5adb43..071d40c 100644 --- a/conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml +++ b/conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml @@ -212,7 +212,7 @@ spec: description: 'sonarr has been unreachable for 5m (SLI: up).' --- # Flux ImageRepository (R-UPD) -apiVersion: image.toolkit.fluxcd.io/v1beta2 +apiVersion: image.toolkit.fluxcd.io/v1 kind: ImageRepository metadata: name: sonarr @@ -222,7 +222,7 @@ spec: interval: 1h0m0s --- # Flux ImagePolicy (R-UPD) -apiVersion: image.toolkit.fluxcd.io/v1beta2 +apiVersion: image.toolkit.fluxcd.io/v1 kind: ImagePolicy metadata: name: sonarr diff --git a/conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml b/conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml index 5093288..5620a46 100644 --- a/conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml +++ b/conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml @@ -212,7 +212,7 @@ spec: description: 'sonarr has been unreachable for 5m (SLI: up).' --- # Flux ImageRepository (R-UPD) -apiVersion: image.toolkit.fluxcd.io/v1beta2 +apiVersion: image.toolkit.fluxcd.io/v1 kind: ImageRepository metadata: name: sonarr @@ -222,7 +222,7 @@ spec: interval: 1h0m0s --- # Flux ImagePolicy (R-UPD) -apiVersion: image.toolkit.fluxcd.io/v1beta2 +apiVersion: image.toolkit.fluxcd.io/v1 kind: ImagePolicy metadata: name: sonarr diff --git a/conformance/tests/l3-fault-injection/hands-off-update/chainsaw-test.yaml b/conformance/tests/l3-fault-injection/hands-off-update/chainsaw-test.yaml index 4738135..77af023 100644 --- a/conformance/tests/l3-fault-injection/hands-off-update/chainsaw-test.yaml +++ b/conformance/tests/l3-fault-injection/hands-off-update/chainsaw-test.yaml @@ -72,7 +72,7 @@ spec: # resolution — proving it advanced the selection with zero hand-authored change. # ========================================================================================= kubectl -n "$NS" apply -f - <<'EOF' - apiVersion: image.toolkit.fluxcd.io/v1beta2 + apiVersion: image.toolkit.fluxcd.io/v1 kind: ImageRepository metadata: name: podinfo @@ -80,7 +80,7 @@ spec: image: ghcr.io/stefanprodan/podinfo interval: 1m --- - apiVersion: image.toolkit.fluxcd.io/v1beta2 + apiVersion: image.toolkit.fluxcd.io/v1 kind: ImagePolicy metadata: name: podinfo-stable @@ -94,7 +94,7 @@ spec: semver: range: '>=6.0.0 <7.0.0' --- - apiVersion: image.toolkit.fluxcd.io/v1beta2 + apiVersion: image.toolkit.fluxcd.io/v1 kind: ImagePolicy metadata: name: podinfo-pinned diff --git a/platform/image-automation/image-update-automation.yaml b/platform/image-automation/image-update-automation.yaml index 210a228..e63a969 100644 --- a/platform/image-automation/image-update-automation.yaml +++ b/platform/image-automation/image-update-automation.yaml @@ -15,7 +15,7 @@ # flux-system install (bootstrap/flux/bootstrap.sh `--components-extra`), so the image.toolkit CRDs # pre-exist before reconcile — this CR applies cleanly without the F-MON1 controllers/configs split # (the CRD is present at bootstrap, exactly like GitRepository/Kustomization are). See README.md. -apiVersion: image.toolkit.fluxcd.io/v1beta2 +apiVersion: image.toolkit.fluxcd.io/v1 kind: ImageUpdateAutomation metadata: name: flux-image-automation diff --git a/platform/image-automation/per-service/pihole.example.yaml b/platform/image-automation/per-service/pihole.example.yaml index 538d872..b7ba2c8 100644 --- a/platform/image-automation/per-service/pihole.example.yaml +++ b/platform/image-automation/per-service/pihole.example.yaml @@ -11,7 +11,7 @@ # # See ./README.md for the field-by-field contract. # --------------------------------------------------------------------------------------------------- -apiVersion: image.toolkit.fluxcd.io/v1beta2 +apiVersion: image.toolkit.fluxcd.io/v1 kind: ImageRepository metadata: name: pihole @@ -21,7 +21,7 @@ spec: interval: 6h # scan schedule; nearest Flux duration to cadence "0 4 * * *" (daily-ish) # provider: generic # dockerhub anon; a pull secret goes here if registry rate-limits bite --- -apiVersion: image.toolkit.fluxcd.io/v1beta2 +apiVersion: image.toolkit.fluxcd.io/v1 kind: ImagePolicy metadata: name: pihole