---
# Flux image-update-automation — the CLUSTER-WIDE write-back engine for hands-off image tag advances
# (ADR-0009, R-UPD-02). image-reflector-controller scans each per-service ImageRepository on its
# interval; image-automation-controller resolves each ImagePolicy and writes the advanced tag back to
# git at the `# {"$imagepolicy": "..."}` setter markers. The commit is MACHINE-authored under the
# operator's once-declared policy — no human/AI edits a tag (R-UPD-01/02).
#
# SCOPE (contract, roadmap/workstreams.md "Update policy contract"): this dir holds ONLY the
# cluster-wide ImageUpdateAutomation + git write-back settings. PER-SERVICE ImageRepository/ImagePolicy
# are rendered from each ServiceDefinition's `update` block (renderer-contract §update) and live NEXT
# TO each app's Deployment/HelmRelease under apps/ — see ./per-service/ for the render contract + a
# worked example. Helm CHART / dependency bumps are Renovate's job (renovate.json), not this controller.
#
# CONTROLLERS: image-reflector-controller + image-automation-controller are installed as part of the
# flux-system install (bootstrap/flux/bootstrap.sh `--components-extra`), so the image.toolkit CRDs
# pre-exist before reconcile — this CR applies cleanly without the F-MON1 controllers/configs split
# (the CRD is present at bootstrap, exactly like GitRepository/Kustomization are). See README.md.
apiVersion: image.toolkit.fluxcd.io/v1
kind: ImageUpdateAutomation
metadata:
  name: flux-image-automation
  namespace: flux-system
spec:
  # The scan/apply schedule (R-UPD-02). image-reflector scans registries continuously per
  # ImageRepository.spec.interval; this interval bounds how often resolved tags are written back.
  interval: 30m
  sourceRef:
    kind: GitRepository
    name: flux-system
    # ^ Write-back auth REUSES this GitRepository's `.spec.secretRef` (image-automation-controller has
    #   no independent secretRef). The Phase-1 flux-system source is currently anonymous/read-only
    #   (public host-Gitea clone). For write-back the operator must attach a WRITE credential to the
    #   flux-system GitRepository — see README.md "Operator hand-off: git write credential" and the
    #   SOPS template bootstrap/sops/secret-templates/gitea-image-automation-credentials.yaml.example.
  git:
    checkout:
      ref:
        branch: main            # reconciled branch (matches clusters/base/flux-system.yaml)
    commit:
      author:
        # Machine author — the auditable, intended write-back (ADR-0009). No human/AI authors the bump.
        name: fluxcdbot
        email: fluxcdbot@users.noreply.home.keithjackson.dev
      messageTemplate: |
        chore(images): automated stable update [ci skip]

        Machine-authored image tag advance under the declared per-service ImagePolicy
        (R-UPD-01 stable-only, R-UPD-02 no human/AI authoring). ADR-0009.
        {{ range .Changed.Changes -}}
        - {{ .OldValue }} -> {{ .NewValue }} ({{ .Setter }})
        {{ end -}}
    push:
      branch: main             # push straight to the tracked branch (default write-back strategy,
                               # ADR-0009). Renovate handles PR-style bumps for charts/deps separately.
  update:
    strategy: Setters          # advance the `$imagepolicy` setter markers in per-service manifests
    path: ./apps               # only apps/ carries per-service image markers (platform charts = Renovate)