jakman85andClaude Opus 4.8
37f4fa6767
Install image-reflector-controller + image-automation-controller as part of the flux-system install (bootstrap.sh --components-extra) so the image.toolkit CRDs pre-exist before reconcile — no F-MON1 split needed for the ImageUpdateAutomation CR. Refine the cluster-wide ImageUpdateAutomation for machine-authored git write-back (setter strategy, path ./apps) reusing the flux-system GitRepository secretRef, and document the operator git-write-credential hand-off + SOPS secret template (gitea-image-automation-credentials). image-automation stays deferred in platform/kustomization.yaml until that credential is provisioned. Co-Authored-By: Claude Opus 4.8 <[email protected]>
36 lines
2.2 KiB
Plaintext
36 lines
2.2 KiB
Plaintext
# =============================================================================
|
|
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
|
|
# and never auto-encrypted by SOPS). Reference scaffold only.
|
|
#
|
|
# PURPOSE: the git WRITE credential Flux image-automation uses to commit machine-authored image tag
|
|
# advances back to the GitOps source (ADR-0009, R-UPD-02). image-automation-controller has NO secretRef
|
|
# of its own — it reuses the `flux-system` GitRepository's `.spec.secretRef`. So this Secret is wired
|
|
# onto the flux-system GitRepository, NOT onto the ImageUpdateAutomation.
|
|
#
|
|
# (a) Generate a Gitea access token (scope: write:repository) for the bootstrap bot user, e.g.:
|
|
# curl -s -u <admin> -X POST http://10.73.0.1:3000/api/v1/users/fluxcdbot/tokens \
|
|
# -H 'content-type: application/json' \
|
|
# -d '{"name":"image-automation","scopes":["write:repository"]}'
|
|
# (the operator's bash step; store the returned token straight into this file — never print it).
|
|
# (b) Copy to: platform/image-automation/gitea-image-automation-credentials.sops.yaml
|
|
# add under `resources:` in platform/image-automation/kustomization.yaml:
|
|
# - gitea-image-automation-credentials.sops.yaml
|
|
# (c) Encrypt: sops --encrypt --in-place platform/image-automation/gitea-image-automation-credentials.sops.yaml
|
|
# (d) Consume it: attach to the flux-system GitRepository via the bootstrap source-url patch
|
|
# (bootstrap/flux/patches/flux-system-source-url.yaml) by adding:
|
|
# spec:
|
|
# secretRef:
|
|
# name: gitea-image-automation-credentials
|
|
# NOTE: the Secret must live in the flux-system namespace (same as the GitRepository).
|
|
# Basic-auth keys are `username` + `password` (Gitea accepts the token as password).
|
|
# =============================================================================
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: gitea-image-automation-credentials
|
|
namespace: flux-system
|
|
type: Opaque
|
|
stringData:
|
|
username: fluxcdbot
|
|
password: REPLACE-ME # Gitea access token with write:repository scope (NOT a login password)
|