docs: document the ImageUpdateAutomation namespace-scoping requirement

Cross-referencing image-automation.yaml's own comment explaining the
namespace-matching bug that caused Setters to silently no-op for hours
of investigation - worth calling out in the walkthrough itself since it
fails with no error at all, just an endless "repository up-to-date".

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y4YNpuC2bgT224suQLLJ7B
This commit is contained in:
CodeGit 2026-09-04 12:27:06 +01:00
parent 10846d1082
commit 9d772f68d2

View file

@ -402,7 +402,16 @@ What it does need, that podinfo/headlamp don't, is a way to notice when CI
publishes a new image and roll it out — that's
`apps/hello-app/image-automation.yaml`'s job
(`ImageRepository`/`ImagePolicy`/`ImageUpdateAutomation`, all commented in
that file).
that file). One easy-to-miss requirement, worth calling out explicitly
since getting it wrong fails silently: `ImageUpdateAutomation` must live
in the *same namespace* as the `ImagePolicy` it targets — the controller
only ever lists `ImagePolicy` objects from its own namespace, so a
cross-namespace `$imagepolicy` marker matches nothing, and every
reconcile just reports "repository up-to-date" with no error and no
commit, no matter how correct the marker syntax, RBAC, or policy
resolution otherwise are (see `image-automation.yaml`'s own comment for
the exact controller source line this comes from). `GitRepository` itself
is fine to reference cross-namespace, via `sourceRef.namespace`.
Exercise the whole loop end to end. Unlike the rest of this stage, this
runs on your **desktop** (the `maq` clone from `docs/01-bootstrap.md` step