> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo Image Automation Controller Policy

> Guide to using Flux ImagePolicy to select a latest image tag from an ImageRepository using policies like semver, and explains reconciliation and need for ImageUpdateAutomation to update manifests

This guide shows how to use Flux's ImagePolicy CRD to select the "latest" image tag from an ImageRepository using a policy (for example, the highest patch version matching a semver range). It assumes you already have an ImageRepository that lists tags from your registry.

Open your repository in Visual Studio Code and follow along.

## Overview

* ImageRepository discovers and lists tags for an image in a registry.
* ImagePolicy consumes an ImageRepository's tag list and resolves a single "latest" image according to a configured policy (semver, alphabetical, numeric, etc.).

| Resource | Purpose | Example |
| - | - | - |
| ImageRepository | Discovers tags in a registry | See Flux ImageRepository docs: [https://fluxcd.io/docs/components/image/](https://fluxcd.io/docs/components/image/) |
| ImagePolicy | Resolves a single latest tag using a policy | `semver`, `alphabetical`, `numeric`, with optional `filterTags` |

## Create an ImagePolicy

The following ImagePolicy references an existing ImageRepository (named `8-demo-image-repo-bb-app`) and selects the highest patch version within the `7.8.x` series:

```yaml theme={null}
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImagePolicy
metadata:
  name: 8-demo-image-policy-bb-app
  namespace: flux-system
spec:
  imageRepositoryRef:
    name: 8-demo-image-repo-bb-app
  policy:
    semver:
      range: 7.8.x
```

Generate and export the ImagePolicy YAML to your cluster repo (example path used here):

```bash theme={null}
cd ../../block-buster/flux-clusters/dev-cluster/

flux create image policy 8-demo-image-policy-bb-app \
  --image-ref=8-demo-image-repo-bb-app \
  --select-semver 7.8.x \
  --export > 8-demo-image-policy-bb-app.yaml
```

Then commit and push the file to your Flux-managed Git repository so Flux can reconcile it:

```bash theme={null}
git add 8-demo-image-policy-bb-app.yaml
git commit -m "Add ImagePolicy for bb-app (7.8.x)"
git push
```

## How the policy selects the image

* The example uses `semver` with range `7.8.x`. Flux will consider tags where `major=7` and `minor=8`, then pick the highest patch (e.g., `7.8.1` > `7.8.0`).
* Flux supports other policy strategies:
  * `semver` — semantic version comparison with ranges
  * `alphabetical` — lexicographic comparison of tags
  * `numeric` — numeric comparison of tag values
* You can combine `filterTags` to restrict which tags are considered (for example, to select release candidates).

Example: basic semver policy

```yaml theme={null}
---
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImagePolicy
metadata:
  name: podinfo
spec:
  imageRepositoryRef:
    name: podinfo
  policy:
    semver:
      range: '>=1.0.0'
```

Example: filtering tags (e.g., release candidates)

```yaml theme={null}
---
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImagePolicy
metadata:
  name: podinfo
spec:
  imageRepositoryRef:
    name: podinfo
  filterTags:
    pattern: '.*-rc.*'
  policy:
    semver:
      range: '^1.x-0'
```

## Apply and let Flux reconcile

Once committed to the repository Flux manages, Flux will scan the referenced ImageRepository and resolve the latest image according to your ImagePolicy. Allow some time for the reconciliation loop to run.

## Inspecting results with the Flux CLI

List discovered repositories and resolved policies:

```bash theme={null}
flux get image all
```

Example output (imagerepository entry):

```text theme={null}
NAME                                  LAST SCAN                 SUSPENDED  READY  MESSAGE
imagerepository/8-demo-image-repo-bb-app 2023-04-06T19:36:50+05:30  False      True   successful scan: found 2 tags
```

Example output (imagepolicy entry):

```text theme={null}
NAME                                  LATEST IMAGE                                      READY  MESSAGE
imagepolicy/8-demo-image-policy-bb-app docker.io/siddharth67/bb-app-flux-demo:7.8.1   True   Latest image tag for 'docker.io/siddharth67/bb-app-flux-demo' resolved to 7.8.1
```

You can also inspect the ImagePolicy resource directly with kubectl to see status conditions and the resolved tag in the `status` section:

```bash theme={null}
kubectl -n flux-system get imagepolicy 8-demo-image-policy-bb-app -o yaml
```

## Important: ImagePolicy does not mutate Deployments

Creating an ImagePolicy only resolves which tag is considered "latest" under your policy. It does not update workload manifests or change images in running Deployments by itself.

For example, the workload in the `8-demo` namespace may still be using tag `7.8.0`:

```bash theme={null}
kubectl -n 8-demo get deploy block-buster -o wide
```

Example output:

```text theme={null}
NAME         READY  UP-TO-DATE  AVAILABLE  AGE   CONTAINERS  IMAGES                                   SELECTOR
block-buster 1/1    1           1          29m   app         siddharth67/bb-app-flux-demo:7.8.0      app=block-buster
```

To automatically update the image tag in your Git repository (and therefore apply the change to the cluster), you must configure the ImageUpdateAutomation controller and related image automation CRDs. ImageUpdateAutomation watches image policies and image repositories and commits updated manifests back to Git. Wiring ImageUpdateAutomation to ImagePolicy and ImageRepository is covered in separate guides.

ImagePolicy resolves the latest tag per your policy but does not mutate Deployments. To automatically update manifest files (and apply those changes to the cluster via GitOps), configure ImageUpdateAutomation to commit the updated image tags to your Git repository.

## Links and references

* Flux Image components: [https://fluxcd.io/docs/components/image/](https://fluxcd.io/docs/components/image/)
* Flux CLI: [https://fluxcd.io/docs/flux/cli/](https://fluxcd.io/docs/flux/cli/)
* ImageAutomation and ImageUpdateAutomation: [https://fluxcd.io/docs/guides/image-update/](https://fluxcd.io/docs/guides/image-update/)
* kubectl reference: [https://kubernetes.io/docs/reference/kubectl/overview/](https://kubernetes.io/docs/reference/kubectl/overview/)

> **[Watch Video](https://learn.kodekloud.com/user/courses/gitops-with-fluxcd/module/e4076c7b-6728-412c-b4d7-9316fc346fc5/lesson/57e394ef-ba09-463d-a515-772847e10df6)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.