Update image tag using webhook

[fl42]

Hello,

At the moment Flux2 is able to discover new image tags in registry and commit them to the git repo.

It would be useful to be able to trigger an image tag update using webhook (ideally with the ability to restrict a webhook endpoint to some images, i.e. scoped webhook)
This would allow a less-trusted user (e.g. CI system) to update image tag without giving it full write access to gitops repo.

Or there is another (already existing?) solution for this use case?

Thanks

[stefanprodan]

Please check out the docs: https://toolkit.fluxcd.io/guides/image-update/#trigger-image-updates-with-webhooks

[fl42]

Thanks for the hint
Indeed I had a look to this page, but I thought it was only to trigger an immediate scan of the registry, isn't it?

Could I create only an ImageRepository and a generic Receiver objects?
Then how to specify the image tag in the webhook POST request? (where could I find the schema for the generic webhook format?)
I don't need (and want) registry scan, because I may push images not yet ready for prod, so I would trigger the deployment at a later stage of the CI pipeline.

Thanks for your quick answer

[stefanprodan]

I don't need (and want) registry scan, because I may push images not yet ready for prod, so I would trigger the deployment at a later stage of the CI pipeline.

dev and prod should be represented by two ImagePolicies, then in the ImageUpdateAutomation objects you set the path to the dev/prod clusters.

[fl42]

If I set the version in ImagePolicy objects, the object needs to be patched for version bump (considering I have only one registry with tag app:v1.0, app:v1.1, etc, and I don't want that v1.1 is deployed to prod as soon as pushed)
However the goal is to avoid giving write access to the gitops repo to the CI system :)

Another option is to use prefix for tags (e.g. prod-, dev-) but this double the number of images in the registry (not the size). It may be the cleanest option with the current set of features.