jakman85andClaude Opus 4.8
af4f6c07ae
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
30 lines
1.7 KiB
Markdown
30 lines
1.7 KiB
Markdown
# platform/image-automation
|
|
|
|
**Flux image-update-automation** — hands-off container image tag advances driven by declared policy.
|
|
|
|
- **Governing ADR:** [ADR-0009 — Automated updates: Flux image automation + Renovate](../../../home-network-k3s/decisions/adr-0009-automated-image-updates.md)
|
|
- **Spec:** [docs/11 — Automated Updates](../../../home-network-k3s/docs/11-automated-updates.md),
|
|
[docs/05 §Automated updates interplay](../../../home-network-k3s/docs/05-gitops-and-delivery.md)
|
|
- **Serves:** R-UPD-02 (with R-UPD-01/03 safety rails)
|
|
- **Owner:** WS-UPDATE (mechanism), WS-GITOPS (policy rendering from ServiceDefinition)
|
|
|
|
## What this stub is
|
|
|
|
The **cluster-wide** `ImageUpdateAutomation` that scans registries and **commits the resolved version
|
|
back to git** (machine-authored, auditable — ADR-0009). No human or AI authors a tag bump (R-UPD-02).
|
|
|
|
## Scope boundary (contract)
|
|
|
|
This dir holds **only** the cluster-wide automation + git write-back settings. **Per-service**
|
|
`ImageRepository` / `ImagePolicy` (semver range / stable channel) are rendered from each
|
|
ServiceDefinition's `update` block by WS-GITOPS/WS-UPDATE and live with `apps/` — the "Update policy
|
|
contract" in `roadmap/workstreams.md`. **Helm chart / manifest bumps** are Renovate's job (separate),
|
|
not this controller's.
|
|
|
|
## TODO (later phases — Phase 4)
|
|
|
|
- Confirm write-back strategy (direct commit to tracked branch vs. Renovate-style PRs).
|
|
- Wire the safety rails that are **acceptance gates** (ADR-0009): stable-only, health-gated rollout,
|
|
auto-rollback on failed health, `pin` escape hatch, alert on update failure.
|
|
- Requires the Flux **image-reflector** + **image-automation** controllers (Flux bootstrap component).
|