feat: deploy backstage latest via Flux image automation

Install image-reflector and image-automation controllers, track the digest behind backstage:latest, and let flux-bot commit digest updates to main. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-01 16:05:13 +00:00
parent 53e2854993
commit 7f5bef829f
10 changed files with 1422 additions and 2 deletions
@@ -0,0 +1,19 @@
+# Gitea token of the private `flux-bot` user: collaborator with write on
+# homelab-infra only, token scoped to write:repository. Stored in OpenBao as
+# username/password because that is the basic-auth Secret shape Flux reads.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: homelab-infra-write
+  namespace: flux-system
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    creationPolicy: Owner
+    name: homelab-infra-write
+  dataFrom:
+    - extract:
+        key: k8s/flux-image-automation