jakman85andClaude Opus 4.8
37f4fa6767
Install image-reflector-controller + image-automation-controller as part of the flux-system install (bootstrap.sh --components-extra) so the image.toolkit CRDs pre-exist before reconcile — no F-MON1 split needed for the ImageUpdateAutomation CR. Refine the cluster-wide ImageUpdateAutomation for machine-authored git write-back (setter strategy, path ./apps) reusing the flux-system GitRepository secretRef, and document the operator git-write-credential hand-off + SOPS secret template (gitea-image-automation-credentials). image-automation stays deferred in platform/kustomization.yaml until that credential is provisioned. Co-Authored-By: Claude Opus 4.8 <[email protected]>
58 lines
3.4 KiB
YAML
58 lines
3.4 KiB
YAML
---
|
|
# Flux image-update-automation — the CLUSTER-WIDE write-back engine for hands-off image tag advances
|
|
# (ADR-0009, R-UPD-02). image-reflector-controller scans each per-service ImageRepository on its
|
|
# interval; image-automation-controller resolves each ImagePolicy and writes the advanced tag back to
|
|
# git at the `# {"$imagepolicy": "..."}` setter markers. The commit is MACHINE-authored under the
|
|
# operator's once-declared policy — no human/AI edits a tag (R-UPD-01/02).
|
|
#
|
|
# SCOPE (contract, roadmap/workstreams.md "Update policy contract"): this dir holds ONLY the
|
|
# cluster-wide ImageUpdateAutomation + git write-back settings. PER-SERVICE ImageRepository/ImagePolicy
|
|
# are rendered from each ServiceDefinition's `update` block (renderer-contract §update) and live NEXT
|
|
# TO each app's Deployment/HelmRelease under apps/ — see ./per-service/ for the render contract + a
|
|
# worked example. Helm CHART / dependency bumps are Renovate's job (renovate.json), not this controller.
|
|
#
|
|
# CONTROLLERS: image-reflector-controller + image-automation-controller are installed as part of the
|
|
# flux-system install (bootstrap/flux/bootstrap.sh `--components-extra`), so the image.toolkit CRDs
|
|
# pre-exist before reconcile — this CR applies cleanly without the F-MON1 controllers/configs split
|
|
# (the CRD is present at bootstrap, exactly like GitRepository/Kustomization are). See README.md.
|
|
apiVersion: image.toolkit.fluxcd.io/v1beta2
|
|
kind: ImageUpdateAutomation
|
|
metadata:
|
|
name: flux-image-automation
|
|
namespace: flux-system
|
|
spec:
|
|
# The scan/apply schedule (R-UPD-02). image-reflector scans registries continuously per
|
|
# ImageRepository.spec.interval; this interval bounds how often resolved tags are written back.
|
|
interval: 30m
|
|
sourceRef:
|
|
kind: GitRepository
|
|
name: flux-system
|
|
# ^ Write-back auth REUSES this GitRepository's `.spec.secretRef` (image-automation-controller has
|
|
# no independent secretRef). The Phase-1 flux-system source is currently anonymous/read-only
|
|
# (public host-Gitea clone). For write-back the operator must attach a WRITE credential to the
|
|
# flux-system GitRepository — see README.md "Operator hand-off: git write credential" and the
|
|
# SOPS template bootstrap/sops/secret-templates/gitea-image-automation-credentials.yaml.example.
|
|
git:
|
|
checkout:
|
|
ref:
|
|
branch: main # reconciled branch (matches clusters/base/flux-system.yaml)
|
|
commit:
|
|
author:
|
|
# Machine author — the auditable, intended write-back (ADR-0009). No human/AI authors the bump.
|
|
name: fluxcdbot
|
|
email: [email protected]
|
|
messageTemplate: |
|
|
chore(images): automated stable update [ci skip]
|
|
|
|
Machine-authored image tag advance under the declared per-service ImagePolicy
|
|
(R-UPD-01 stable-only, R-UPD-02 no human/AI authoring). ADR-0009.
|
|
{{ range .Changed.Changes -}}
|
|
- {{ .OldValue }} -> {{ .NewValue }} ({{ .Setter }})
|
|
{{ end -}}
|
|
push:
|
|
branch: main # push straight to the tracked branch (default write-back strategy,
|
|
# ADR-0009). Renovate handles PR-style bumps for charts/deps separately.
|
|
update:
|
|
strategy: Setters # advance the `$imagepolicy` setter markers in per-service manifests
|
|
path: ./apps # only apps/ carries per-service image markers (platform charts = Renovate)
|