feat(wiki-index): roll out every build via Flux image automation

Replaces the per-commit tag pin with the house pattern: the build publishes build.<unix-ts>, an ImageRepository/ImagePolicy pair tracks it (numerical, newest wins), and the deployment carries the $imagepolicy marker so the shared ImageUpdateAutomation bumps it. No more hand-pinned digests, no same-day tag races. The reflector reads the package anonymously like the other Gitea-hosted images. The deployment keeps the verified 2026-09-20-4b529cd1 tag as its starting value; the first build.* tag after merge replaces it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-20 11:04:04 +02:00
4 changed files with 35 additions and 7 deletions
@@ -396,16 +396,17 @@ steps:
      - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
      - TAG=$(date +%Y-%m-%d)
-      # Also a per-commit tag: several builds a day (branch pushes and the
-      # merge) all rewrite the dated tag, and the deployment pin raced them
-      # on 2026-09-20. The commit tag is immutable and needs no digest lookup.
-      - SHORT=$(printf '%s' "$CI_COMMIT_SHA" | cut -c1-8)
+      # `build.<unix-ts>` is the tag Flux image automation tracks
+      # (infrastructure/image-automation/wiki-index.yaml): unique per build, so
+      # every push rolls out without a hand-pinned digest. The dated tag is
+      # rewritten several times a day and is kept for humans only.
+      - BUILD=build.$(date +%s)
      - |
        /kaniko/executor \
          --context . \
          --dockerfile Containerfile \
          --destination gitea.renner.uno/gitea_admin/wiki-index:$TAG \
-          --destination gitea.renner.uno/gitea_admin/wiki-index:$TAG-$SHORT \
+          --destination gitea.renner.uno/gitea_admin/wiki-index:$BUILD \
          --destination gitea.renner.uno/gitea_admin/wiki-index:latest

  # bird: BGP daemon for the pod-network mesh over pod0 (#576). Runtime
@@ -56,8 +56,8 @@ spec:
          type: RuntimeDefault
      containers:
        - name: wiki-index
-          # Per-commit tag (build-ci-images.yml): immutable, no same-day overwrite.
-          image: gitea.renner.uno/gitea_admin/wiki-index:2026-09-20-4b529cd1
+          # Flux image automation bumps this to the newest build.<unix-ts> tag.
+          image: gitea.renner.uno/gitea_admin/wiki-index:2026-09-20-4b529cd1 # {"$imagepolicy": "flux-system:wiki-index"}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
@@ -24,5 +24,6 @@ resources:
  - valkey.yaml
  - velero-plugin-for-aws.yaml
  - vsftpd.yaml
+  - wiki-index.yaml
  - woodpecker.yaml
  - wyoming.yaml
@@ -0,0 +1,26 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: wiki-index
+  namespace: flux-system
+spec:
+  image: gitea.renner.uno/gitea_admin/wiki-index
+  interval: 10m
+---
+# build-ci-images.yml publishes `build.<unix-ts>` alongside the dated tag so
+# every build rolls out on its own; the dated tag is rewritten several times a
+# day and cannot be tracked.
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: wiki-index
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: wiki-index
+  filterTags:
+    pattern: '^build\.(?P<ts>\d+)$'
+    extract: '$ts'
+  policy:
+    numerical:
+      order: asc