10846d1082
ImageUpdateAutomation only lists ImagePolicy objects in its own
namespace (image-automation-controller's getPolicies() scopes the
List() to obj.Namespace, confirmed by reading v1.2.4 source) - the
$imagepolicy marker's namespace:name is only used to match against
that pre-filtered list, not to broaden the search. Our
ImageUpdateAutomation lived in flux-system while its ImagePolicy
lived in hello-app, so the policy was invisible and Setters always
found zero markers to update ("repository up-to-date" forever),
regardless of correct marker syntax/RBAC/policy resolution.
Moved ImageUpdateAutomation into the hello-app namespace (alongside
its ImagePolicy), keeping a cross-namespace sourceRef back to the
flux-system GitRepository. Also fixed the commit messageTemplate,
which used the removed .Updated field (v1.2.4 requires .Changed).
Verified live: Flux pushed commit 0273f15 updating deployment.yaml's
tag on its own, and the cluster rolled out that image without any CI
involvement. Removed the update-deployment-tag CI workaround job
accordingly - it's redundant now and would otherwise race with
Flux's own commits.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GJNvvV3RrvX6TRZGAKEUeY
72 lines
2.1 KiB
YAML
72 lines
2.1 KiB
YAML
# Flux image automation: watches the Forgejo registry for new hello-app
|
|
# tags, and rewrites deployment.yaml's image tag + commits back to this repo
|
|
# when one shows up. Requires clusters/homelab/flux-system to have write
|
|
# access to the Forgejo repo (flux bootstrap sets this up).
|
|
#
|
|
# ImageUpdateAutomation must live in the SAME namespace as the ImagePolicy
|
|
# it targets - the controller only ever lists ImagePolicy objects from its
|
|
# own namespace (internal/controller/imageupdateautomation_controller.go's
|
|
# getPolicies() scopes the List() call to obj.Namespace), so a
|
|
# cross-namespace $imagepolicy marker silently matches nothing and every
|
|
# reconcile reports "repository up-to-date" with no commit, regardless of
|
|
# how correct the marker/RBAC/policy resolution otherwise are. GitRepository
|
|
# itself can still be referenced cross-namespace via sourceRef.namespace.
|
|
|
|
apiVersion: image.toolkit.fluxcd.io/v1
|
|
kind: ImageRepository
|
|
metadata:
|
|
name: hello-app
|
|
namespace: hello-app
|
|
spec:
|
|
image: git.boglabob.com/codegit/hello-app
|
|
interval: 1m
|
|
# Uncomment + create the secret if the package is private.
|
|
# secretRef:
|
|
# name: forgejo-registry
|
|
---
|
|
apiVersion: image.toolkit.fluxcd.io/v1
|
|
kind: ImagePolicy
|
|
metadata:
|
|
name: hello-app
|
|
namespace: hello-app
|
|
spec:
|
|
imageRepositoryRef:
|
|
name: hello-app
|
|
policy:
|
|
numerical:
|
|
order: asc
|
|
filterTags:
|
|
pattern: '^main-[a-f0-9]+-(?P<ts>\d+)$'
|
|
extract: '$ts'
|
|
---
|
|
apiVersion: image.toolkit.fluxcd.io/v1
|
|
kind: ImageUpdateAutomation
|
|
metadata:
|
|
name: hello-app
|
|
namespace: hello-app
|
|
spec:
|
|
interval: 1m
|
|
sourceRef:
|
|
kind: GitRepository
|
|
name: flux-system
|
|
namespace: flux-system
|
|
git:
|
|
checkout:
|
|
ref:
|
|
branch: main
|
|
commit:
|
|
author:
|
|
email: flux@boglabob.com
|
|
name: fluxcdbot
|
|
messageTemplate: |
|
|
chore(hello-app): auto-update image
|
|
{{ range $resource, $changes := .Changed.Objects -}}
|
|
{{ range $_, $change := $changes -}}
|
|
{{ $change.NewValue }}
|
|
{{ end -}}
|
|
{{ end -}}
|
|
push:
|
|
branch: main
|
|
update:
|
|
path: ./apps/hello-app
|
|
strategy: Setters
|