# platform/image-automation

**Flux image-update-automation** — hands-off container image tag advances driven by declared policy.

- **Governing ADR:** [ADR-0009 — Automated updates: Flux image automation + Renovate](../../../home-network-k3s/decisions/adr-0009-automated-image-updates.md)
- **Spec:** [docs/11 — Automated Updates](../../../home-network-k3s/docs/11-automated-updates.md),
  [docs/05 §Automated updates interplay](../../../home-network-k3s/docs/05-gitops-and-delivery.md)
- **Serves:** R-UPD-02 (with R-UPD-01/03 safety rails)
- **Owner:** WS-UPDATE (mechanism), WS-GITOPS (policy rendering from ServiceDefinition)

## What this stub is

The **cluster-wide** `ImageUpdateAutomation` that scans registries and **commits the resolved version
back to git** (machine-authored, auditable — ADR-0009). No human or AI authors a tag bump (R-UPD-02).

## Scope boundary (contract)

This dir holds **only** the cluster-wide automation + git write-back settings. **Per-service**
`ImageRepository` / `ImagePolicy` (semver range / stable channel) are rendered from each
ServiceDefinition's `update` block by WS-GITOPS/WS-UPDATE and live with `apps/` — the "Update policy
contract" in `roadmap/workstreams.md`. **Helm chart / manifest bumps** are Renovate's job (separate),
not this controller's.

## TODO (later phases — Phase 4)

- Confirm write-back strategy (direct commit to tracked branch vs. Renovate-style PRs).
- Wire the safety rails that are **acceptance gates** (ADR-0009): stable-only, health-gated rollout,
  auto-rollback on failed health, `pin` escape hatch, alert on update failure.
- Requires the Flux **image-reflector** + **image-automation** controllers (Flux bootstrap component).