jakman85andClaude Opus 4.8
f538f8ff38
Map a ServiceDefinition `update` block to ImageRepository/ImagePolicy + the $imagepolicy setter marker: stable-only (semver range + bare-X.Y.Z filterTags, pre-release excluded, R-UPD-01), pin -> fixed image with no marker / suspended policy (R-UPD-03). Worked pihole example under per-service/ (reference only, not deployed; WS-GITOPS emits the equivalent into apps/<svc>/). Add renovate.json for Helm chart / dependency / operator-manifest bumps: auto-merge minor/patch/digest on green CI, major needs review, image managers disabled so Renovate never fights Flux over a tag. Co-Authored-By: Claude Opus 4.8 <[email protected]>
76 lines
2.9 KiB
YAML
76 lines
2.9 KiB
YAML
---
|
|
# WORKED EXAMPLE (reference only — NOT wired into a kustomization, never deployed).
|
|
# Rendered from catalog/pihole.yaml's `update` block by WS-GITOSS into apps/pihole/. Shows the exact
|
|
# ImageRepository + ImagePolicy + Deployment setter-marker shape for a container ServiceDefinition.
|
|
#
|
|
# update:
|
|
# channel: stable
|
|
# range: ">=2024.0.0"
|
|
# cadence: "0 4 * * *"
|
|
# autoRollbackOnFailedHealth: true
|
|
#
|
|
# See ./README.md for the field-by-field contract.
|
|
# ---------------------------------------------------------------------------------------------------
|
|
apiVersion: image.toolkit.fluxcd.io/v1beta2
|
|
kind: ImageRepository
|
|
metadata:
|
|
name: pihole
|
|
namespace: pihole
|
|
spec:
|
|
image: pihole/pihole # from source.image
|
|
interval: 6h # scan schedule; nearest Flux duration to cadence "0 4 * * *" (daily-ish)
|
|
# provider: generic # dockerhub anon; a pull secret goes here if registry rate-limits bite
|
|
---
|
|
apiVersion: image.toolkit.fluxcd.io/v1beta2
|
|
kind: ImagePolicy
|
|
metadata:
|
|
name: pihole
|
|
namespace: pihole
|
|
spec:
|
|
imageRepositoryRef:
|
|
name: pihole
|
|
# STABLE-ONLY (R-UPD-01): (1) semver range from `update.range`; (2) a tag filter that admits only
|
|
# bare X.Y.Z releases so a pre-release / `latest` / date-nightly tag can never be selected.
|
|
filterTags:
|
|
pattern: '^v?(?P<v>[0-9]+\.[0-9]+\.[0-9]+)$'
|
|
extract: '$v'
|
|
policy:
|
|
semver:
|
|
range: '>=2024.0.0'
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: pihole
|
|
namespace: pihole
|
|
spec:
|
|
replicas: 1
|
|
# progressDeadlineSeconds bounds a bad rollout so the health gate (readiness probe) can catch it and
|
|
# the old ReplicaSet keeps serving — the plain-Deployment auto-rollback path (R-UPD-03). A
|
|
# HelmRelease-delivered service would instead use spec.upgrade.remediation + spec.rollback.
|
|
progressDeadlineSeconds: 120
|
|
selector:
|
|
matchLabels: { app: pihole }
|
|
template:
|
|
metadata:
|
|
labels: { app: pihole }
|
|
spec:
|
|
containers:
|
|
- name: pihole
|
|
# THE SETTER MARKER: image-automation writes the ImagePolicy-resolved stable tag here.
|
|
# No human/AI ever edits this tag — the marker binds it to the pihole ImagePolicy above.
|
|
image: pihole/pihole:2024.7.0 # {"$imagepolicy": "pihole:pihole"}
|
|
readinessProbe: # the health gate: a bad image never becomes Ready
|
|
httpGet: { path: /admin/, port: 80 }
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 5
|
|
---
|
|
# PINNED VARIANT (R-UPD-03 escape hatch) — what the SAME service renders when `update.pin: "2024.7.0"`
|
|
# is set: the image is fixed, the setter marker is ABSENT, and NO ImagePolicy/ImageRepository is
|
|
# rendered (or it is suspended). Automation cannot advance it. This is the one sanctioned human touch,
|
|
# and it STOPS automation rather than performing an update.
|
|
#
|
|
# containers:
|
|
# - name: pihole
|
|
# image: pihole/pihole:2024.7.0 # pinned — no $imagepolicy marker; automation is frozen
|