# ADR-0009 — Automated updates: Flux image automation + Renovate
- Status: Accepted
- Date: 2026-08-15
- Serves: R-UPD-01, R-UPD-02, R-UPD-03
- Supersedes: —

## Context
Services must advance to the **latest stable** version **on a schedule** with **no human, no AI, and
no hand-authored GitOps change** (R-UPD-02). This must coexist with GitOps (git = source of truth)
and must be safe (stable-only, health-gated, reversible).

## Decision
Split by artifact type:
- **Container image tags → Flux image-update-automation.** Per-service **ImagePolicy** declares the
  acceptable range/channel (semver range or stable tag regex). Flux's image-reflector scans the
  registry on an interval (the schedule) and image-automation advances the running version. The
  policy is the human-authored intent; the version advance is machine-performed — no human/AI edits
  a tag (R-UPD-02).
- **Helm charts / manifests → Renovate.** Renovate opens version-bump PRs; allowed update classes
  **auto-merge** on green CI. Major/breaking bumps may require review per policy.
- **VM guests → in-guest auto-update** (unattended-upgrades/dnf-automatic) declared in the VM's
  cloud-init ([06](../docs/06-vm-workloads-kubevirt.md)).

**Default write-back behavior:** image-automation commits the resolved version back to git (machine-
authored) so history is auditable; a **per-service escape hatch** allows digest-tracking of a mutable
stable tag for zero-commit updates where the operator prefers it. Per-service `update` policy
(channel, range, cadence, pin, autoRollback) lives in the ServiceDefinition ([13](../docs/13-service-catalog.md)).

## Alternatives considered
- **Argo CD Image Updater** — bolt-on to Argo; we chose Flux (ADR-0004) whose image automation is
  first-class.
- **`latest`/`stable` mutable tag + scheduled rollout restart only** — simplest but loses version
  visibility and semver guardrails; offered only as the per-service digest-tracking escape hatch.
- **Human/AI-authored bumps** — explicitly prohibited by R-UPD-02.

## Consequences
- Hands-off updates satisfied via declared policy, not manual/AI edits (R-UPD-02).
- Safety rails required and are acceptance gates: **stable-only**, **health-gated rollout**,
  **auto-rollback** on failed health, **pin** escape hatch, and **alerting** on update failure
  ([10](../docs/10-observability-and-alerting.md), [11](../docs/11-automated-updates.md)).
- Registry rate-limits/credentials for cadence scanning must be handled.
- Machine write-back commits will appear in history — an intended, auditable artifact, not a
  violation of "no hand-authored change."