CodeGit/cloud-demo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: root-cause Flux Setters silent no-op - namespace mismatch

Browse source 
ImageUpdateAutomation only lists ImagePolicy objects in its own
namespace (image-automation-controller's getPolicies() scopes the
List() to obj.Namespace, confirmed by reading v1.2.4 source) - the
$imagepolicy marker's namespace:name is only used to match against
that pre-filtered list, not to broaden the search. Our
ImageUpdateAutomation lived in flux-system while its ImagePolicy
lived in hello-app, so the policy was invisible and Setters always
found zero markers to update ("repository up-to-date" forever),
regardless of correct marker syntax/RBAC/policy resolution.

Moved ImageUpdateAutomation into the hello-app namespace (alongside
its ImagePolicy), keeping a cross-namespace sourceRef back to the
flux-system GitRepository. Also fixed the commit messageTemplate,
which used the removed .Updated field (v1.2.4 requires .Changed).

Verified live: Flux pushed commit 0273f15 updating deployment.yaml's
tag on its own, and the cluster rolled out that image without any CI
involvement. Removed the update-deployment-tag CI workaround job
accordingly - it's redundant now and would otherwise race with
Flux's own commits.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GJNvvV3RrvX6TRZGAKEUeY
This commit is contained in:
k3s kubernetes 2026-09-04 12:05:43 +01:00
parent 0273f15f06
commit 10846d1082
2 changed files with 17 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

19
apps/hello-app/image-automation.yaml
View file

@ -2,6 +2,15 @@
# tags, and rewrites deployment.yaml's image tag + commits back to this repo
# when one shows up. Requires clusters/homelab/flux-system to have write
# access to the Forgejo repo (flux bootstrap sets this up).
#
# ImageUpdateAutomation must live in the SAME namespace as the ImagePolicy
# it targets - the controller only ever lists ImagePolicy objects from its
# own namespace (internal/controller/imageupdateautomation_controller.go's
# getPolicies() scopes the List() call to obj.Namespace), so a
# cross-namespace $imagepolicy marker silently matches nothing and every
# reconcile reports "repository up-to-date" with no commit, regardless of
# how correct the marker/RBAC/policy resolution otherwise are. GitRepository
# itself can still be referenced cross-namespace via sourceRef.namespace.
apiVersion: image.toolkit.fluxcd.io/v1
kind: ImageRepository
@ -34,12 +43,13 @@ apiVersion: image.toolkit.fluxcd.io/v1
kind: ImageUpdateAutomation
metadata:
name: hello-app
namespace: flux-system
namespace: hello-app
spec:
interval: 1m
sourceRef:
kind: GitRepository
name: flux-system
namespace: flux-system
git:
checkout:
ref:
@ -49,7 +59,12 @@ spec:
email: flux@boglabob.com
name: fluxcdbot
messageTemplate: |
chore(hello-app): auto-update image to {{range .Updated.Images}}{{println .}}{{end}}
chore(hello-app): auto-update image
{{ range $resource, $changes := .Changed.Objects -}}
{{ range $_, $change := $changes -}}
{{ $change.NewValue }}
{{ end -}}
{{ end -}}
push:
branch: main
update: