docs: document the ImageUpdateAutomation namespace-scoping requirement

Cross-referencing image-automation.yaml's own comment explaining the
namespace-matching bug that caused Setters to silently no-op for hours
of investigation - worth calling out in the walkthrough itself since it
fails with no error at all, just an endless "repository up-to-date".

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y4YNpuC2bgT224suQLLJ7B
This commit is contained in:
CodeGit 2026-09-04 12:27:06 +01:00
parent 10846d1082
commit 9d772f68d2

View file

@ -402,7 +402,16 @@ What it does need, that podinfo/headlamp don't, is a way to notice when CI
publishes a new image and roll it out — that's publishes a new image and roll it out — that's
`apps/hello-app/image-automation.yaml`'s job `apps/hello-app/image-automation.yaml`'s job
(`ImageRepository`/`ImagePolicy`/`ImageUpdateAutomation`, all commented in (`ImageRepository`/`ImagePolicy`/`ImageUpdateAutomation`, all commented in
that file). that file). One easy-to-miss requirement, worth calling out explicitly
since getting it wrong fails silently: `ImageUpdateAutomation` must live
in the *same namespace* as the `ImagePolicy` it targets — the controller
only ever lists `ImagePolicy` objects from its own namespace, so a
cross-namespace `$imagepolicy` marker matches nothing, and every
reconcile just reports "repository up-to-date" with no error and no
commit, no matter how correct the marker syntax, RBAC, or policy
resolution otherwise are (see `image-automation.yaml`'s own comment for
the exact controller source line this comes from). `GitRepository` itself
is fine to reference cross-namespace, via `sourceRef.namespace`.
Exercise the whole loop end to end. Unlike the rest of this stage, this Exercise the whole loop end to end. Unlike the rest of this stage, this
runs on your **desktop** (the `maq` clone from `docs/01-bootstrap.md` step runs on your **desktop** (the `maq` clone from `docs/01-bootstrap.md` step