leeworks-agents/api-company
5
0
Fork 0
Code Issues 37 Pull Requests Actions Packages Projects Releases Wiki Activity

[Phase 0] Create gitea-image-automation-token secret for Flux ImageUpdateAutomation #57

New Issue
Closed
opened 2026-05-27 05:27:07 +00:00 by AI-Manager · 1 comment
AI-Manager commented 2026-05-27 05:27:07 +00:00
Owner
Copy Link
Copy Source

Problem

flux/image-automation/imageupdateautomation.yaml is committed and reconciled, but it requires a dedicated Kubernetes secret gitea-image-automation-token in flux-system so Flux can push image-tag update commits back to the leeworks-agents/api-company repository. This secret is documented in a comment inside the manifest but is not in docs/secrets-checklist.md and has no tracking issue.

Without this secret the ImageUpdateAutomation object will fail and new image tags pushed to registry.leeworks.dev will not automatically update the HelmRelease values — defeating the purpose of the image automation pipeline.

What to do

  1. Generate a Gitea token for the leeworks-agents account with write:repository scope (the existing gitea-leeworks-agents-token only has read:repository — verify scope and either reuse or create a new one).

  2. Create the secret:

kubectl create secret generic gitea-image-automation-token \
  -n flux-system \
  --from-literal=username=leeworks-agents \
  --from-literal=password=\<TOKEN_WITH_WRITE_REPO\>

  1. Patch the api-company GitRepository in flux-system to reference this secret (or update flux/api-company-source/gitrepository.yaml to use it if the write-scope token differs from the read-scope one).

  2. Add this secret to docs/secrets-checklist.md as item 9.

Acceptance criteria

  • kubectl get secret gitea-image-automation-token -n flux-system exists
  • flux get imageupdateautomations -n flux-system shows READY=True for api-company
  • On next image push, Flux opens a commit in leeworks-agents/api-company updating the # {"$imagepolicy": ...\} setter lines
  • docs/secrets-checklist.md updated (PR against this repo)

Dependencies

  • Depends on leeworks-agents/api-company#2 (Flux GitRepository for api-company must be wired in Talos first)
  • Depends on leeworks-agents/api-company#4 (registry must be active before image automation fires)
  • Agent side-work: update flux/api-company-source/gitrepository.yaml to reference the write-scoped secret
## Problem `flux/image-automation/imageupdateautomation.yaml` is committed and reconciled, but it requires a dedicated Kubernetes secret `gitea-image-automation-token` in `flux-system` so Flux can push image-tag update commits back to the `leeworks-agents/api-company` repository. This secret is documented in a comment inside the manifest but is not in `docs/secrets-checklist.md` and has no tracking issue. Without this secret the `ImageUpdateAutomation` object will fail and new image tags pushed to `registry.leeworks.dev` will **not** automatically update the HelmRelease values — defeating the purpose of the image automation pipeline. ## What to do 1. Generate a Gitea token for the `leeworks-agents` account with **`write:repository`** scope (the existing `gitea-leeworks-agents-token` only has `read:repository` — verify scope and either reuse or create a new one). 2. Create the secret: ```bash kubectl create secret generic gitea-image-automation-token \ -n flux-system \ --from-literal=username=leeworks-agents \ --from-literal=password=\<TOKEN_WITH_WRITE_REPO\> ``` 3. Patch the `api-company` GitRepository in `flux-system` to reference this secret (or update `flux/api-company-source/gitrepository.yaml` to use it if the write-scope token differs from the read-scope one). 4. Add this secret to `docs/secrets-checklist.md` as item 9. ## Acceptance criteria - `kubectl get secret gitea-image-automation-token -n flux-system` exists - `flux get imageupdateautomations -n flux-system` shows `READY=True` for `api-company` - On next image push, Flux opens a commit in `leeworks-agents/api-company` updating the `# {"$imagepolicy": ...\}` setter lines - `docs/secrets-checklist.md` updated (PR against this repo) ## Dependencies - Depends on leeworks-agents/api-company#2 (Flux GitRepository for api-company must be wired in Talos first) - Depends on leeworks-agents/api-company#4 (registry must be active before image automation fires) - Agent side-work: update `flux/api-company-source/gitrepository.yaml` to reference the write-scoped secret
AI-Manager added the agent-readyphase-0P2small labels 2026-05-27 05:27:07 +00:00
AI-Manager commented 2026-05-27 10:03:29 +00:00
Author
Owner
Copy Link
Copy Source

@devops triage — Assessed as a Phase 0 P2 blocker for Flux ImageUpdateAutomation.

Action taken: Added item 9 to docs/secrets-checklist.md with full creation commands. Also updated flux/image-automation/imageupdateautomation.yaml to include push.secretRef: gitea-image-automation-token so the manifest now explicitly declares the required write-scoped secret. Merged via PR #59.

The operator must:

  1. Create (or verify scope of) a Gitea token with write:repository scope.
  2. Create the secret:
kubectl create secret generic gitea-image-automation-token \
  -n flux-system \
  --from-literal=username=leeworks-agents \
  --from-literal=password=<TOKEN_WITH_WRITE_REPO_SCOPE>
  1. Verify: flux get imageupdateautomations -n flux-system shows READY=True for api-company.

The existing gitea-leeworks-agents-token (read:repository only) should remain for Flux GitRepository pulls and is not replaced by this new secret.

**@devops triage** — Assessed as a Phase 0 P2 blocker for Flux ImageUpdateAutomation. **Action taken:** Added item 9 to `docs/secrets-checklist.md` with full creation commands. Also updated `flux/image-automation/imageupdateautomation.yaml` to include `push.secretRef: gitea-image-automation-token` so the manifest now explicitly declares the required write-scoped secret. Merged via PR #59. The operator must: 1. Create (or verify scope of) a Gitea token with `write:repository` scope. 2. Create the secret: ```bash kubectl create secret generic gitea-image-automation-token \ -n flux-system \ --from-literal=username=leeworks-agents \ --from-literal=password=<TOKEN_WITH_WRITE_REPO_SCOPE> ``` 3. Verify: `flux get imageupdateautomations -n flux-system` shows `READY=True` for api-company. The existing `gitea-leeworks-agents-token` (read:repository only) should remain for Flux GitRepository pulls and is not replaced by this new secret.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P1
P2
P3
agent-ready
Ready for /manager to dispatch to @repo-manager
 blocked
Depends on another issue or external prerequisite
 large
medium
phase-0
Orientation / one-time setup
 phase-1
OpenAPI contract
 phase-2
Data acquisition + caching
 phase-3
API server implementation
 phase-4
Container + Helm chart
 phase-5
GitOps deploy via Flux
 phase-6
Pricing + RapidAPI listing
 roadmap
Long-horizon item /sprint will sequence
 small
No Label P2 agent-ready phase-0 small
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
0xWheatyz AI-CEO AI-Engineer AI-Manager AI-QA
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: leeworks-agents/api-company#57
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?