> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# DEMO Image Automation Controller Policy

> This article explains how to use the ImagePolicy CRD in Flux to automatically select the latest image tag based on semantic versioning.

In the previous lesson, we used the `ImageRepository` CRD to retrieve metadata for all available image tags. Now, we’ll introduce the `ImagePolicy` CRD to automatically select the latest tag based on semantic versioning. By the end of this guide, you’ll know how to configure, apply, and verify an `ImagePolicy` in your Flux-enabled Kubernetes cluster.

***

## 1. Create an ImagePolicy

First, open your Flux cluster directory in VS Code:

```bash theme={null}
cd ~/block-buster/flux-clusters/dev-cluster
```

Generate a new `ImagePolicy` manifest that references the existing `ImageRepository` (`8-demo-image-repo-bb-app`) and selects patch releases in the `7.8.x` range:

```bash theme={null}
flux create image policy 8-demo-image-policy-bb-app \
  --image-ref=8-demo-image-repo-bb-app \
  --select-semver 7.8.x \
  --export > 8-demo-image-policy-bb-app.yaml
```

This command outputs a YAML similar to:

```yaml theme={null}
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImagePolicy
metadata:
  name: 8-demo-image-policy-bb-app
  namespace: flux-system
spec:
  imageRepositoryRef:
    name: 8-demo-image-repo-bb-app
  policy:
    semver:
      range: 7.8.x
```

Key fields:

* `imageRepositoryRef.name`: links to the `ImageRepository` you created earlier.
* `policy.semver.range`: `7.8.x` instructs Flux to pick the highest available patch within the 7.8 series.

<Callout icon="lightbulb" color="#1CB2FE">
  Semantic version ranges follow [npm semver syntax](https://github.com/npm/node-semver#ranges); here `7.8.x` matches `7.8.0`, `7.8.1`, etc.
</Callout>

***

## 2. Other Policy Selectors

Flux supports multiple policy strategies for filtering image tags:

| Selector      | Description                          | Example Range |
| ------------- | ------------------------------------ | ------------- |
| `semver`      | Semantic version matching            | `^1.2.0`      |
| `filterTags`  | Regex-based tag filtering            | `'.*-rc.*'`   |
| (no `policy`) | Always pick the latest available tag | —             |

Example: a policy for release candidates (`-rc`):

```yaml theme={null}
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImagePolicy
metadata:
  name: podinfo-rc-policy
spec:
  imageRepositoryRef:
    name: podinfo
  filterTags:
    pattern: '.*-rc.*'
  policy:
    semver:
      range: '^1.x-0'
```

Or a policy that always selects the most recent tag:

```yaml theme={null}
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImagePolicy
metadata:
  name: minio-latest
spec:
  imageRepositoryRef:
    name: minio
  # Omitting `policy` means “pick the very latest tag.”
```

For more examples, see the [Flux Image Policy documentation](https://fluxcd.io/docs/components/image/imagerepositories/#policy).

***

## 3. Apply and Verify the ImagePolicy

1. Commit and push `8-demo-image-policy-bb-app.yaml` to your Git repository.

2. Run Flux CLI to view all image resources:

   ```bash theme={null}
   flux get image all
   ```

   Expected output:

   ```bash theme={null}
   NAME                                        LAST SCAN                SUSPENDED   READY   MESSAGE
   imagerepository/8-demo-image-repo-bb-app    2023-04-06T19:37:25+05:30   False       True    successful scan: found 2 tags
   imagepolicy/8-demo-image-policy-bb-app                      True    Latest image tag for 'docker.io/siddharth67/bb-app-flux-demo' resolved to 7.8.1
   ```

3. For a detailed policy status, inspect the resource in Kubernetes:

   ```bash theme={null}
   kubectl get imagepolicy 8-demo-image-policy-bb-app \
     -n flux-system \
     -o yaml
   ```

   ```yaml theme={null}
   apiVersion: image.toolkit.fluxcd.io/v1beta2
   kind: ImagePolicy
   metadata:
     name: 8-demo-image-policy-bb-app
     namespace: flux-system
   spec:
     imageRepositoryRef:
       name: 8-demo-image-repo-bb-app
     policy:
       semver:
         range: 7.8.x
   status:
     latestImage: docker.io/siddharth67/bb-app-flux-demo:7.8.1
     conditions:
       - type: Ready
         status: "True"
         reason: Succeeded
         message: Latest image tag for 'docker.io/siddharth67/bb-app-flux-demo' resolved to 7.8.1
   ```

***

## 4. Deployment Remains on the Previous Version

Even though the `ImagePolicy` has selected `7.8.1`, your running `Deployment` is still on `7.8.0`:

```bash theme={null}
kubectl -n 8-demo get deploy block-buster -o wide
```

```text theme={null}
NAME          READY   UP-TO-DATE   AVAILABLE   AGE   CONTAINERS   IMAGES                             SELECTOR
block-buster  1/1     1            1           29m   app          siddharth67/bb-app-flux-demo:7.8.0   app=block-buster
```

<Callout icon="triangle-alert" color="#FF6B6B">
  An `ImagePolicy` alone does **not** update running workloads. To automate commits of updated tags back into Git, you’ll need the **ImageUpdateAutomation** controller, which we’ll cover next.
</Callout>

***

## Links and References

* [Flux ImagePolicy Documentation](https://fluxcd.io/docs/components/image/imagerepositories/#policy)
* [Semantic Versioning (semver) Specification](https://semver.org/)
* [Flux CLI Reference](https://fluxcd.io/docs/cli/)

Thank you for following this lesson!

<CardGroup>
  <Card title="Watch Video" icon="video" cta="Learn more" href="https://learn.kodekloud.com/user/courses/gitops-with-fluxcd/module/e4076c7b-6728-412c-b4d7-9316fc346fc5/lesson/57e394ef-ba09-463d-a515-772847e10df6" />
</CardGroup>