| name | image-automation |
| description | Expert knowledge for Flux Image Automation. Use when configuring auto-deploys, debugging image scanners, or updating GitHub credentials. |
| allowed-tools | Bash, Read, Grep, Glob, Edit, Write |
Flux Image Automation
Purpose
Automatically update deployment manifests in git when new images are pushed to GHCR (e.g., mtgibbs.xyz personal site).
Architecture
- ImageRepository: Scans registry (every 5m).
- ImagePolicy: Selects newest tag based on timestamp (
^[0-9]{14}$).
- ImageUpdateAutomation: Commits change to git and pushes.
Configuration
GitHub Token (PAT)
Flux needs write access to the repo. The default deploy key is often read-only.
- Token: Fine-grained PAT
- Permissions: Contents (Read/Write), Administration (Read/Write)
- Secret:
flux-github-pat (Synced from 1Password)
- Expiration: 90 days (Rotate via 1Password)
Manifest Marker
Deployment YAMLs must have the comment marker to be eligible for updates:
image: ghcr.io/mtgibbs/mtgibbs.xyz:20260104084623
Troubleshooting
Check Status
flux get image repository mtgibbs-site
flux get image policy mtgibbs-site
flux get image update mtgibbs-site
Common Issues
- "authentication required": PAT expired or missing permissions.
- No update happening: Check if the marker comment in
deployment.yaml matches the policy name exactly.