Cluster wide ImageUpdateAutomation

[maxkokocom]

Describe the bug

Hi, I wonder how could I allow teams to manage their own ImagePolicies without giving them access to flux-system namespace assuming that's where gitrepository and it's secret is and also making it easier for them.

Initially I was thinking to setup ImageUpdateAutomation in flux-system, but policy in each team kustomize, but it didn't seem to work as ImageUpdateAutomation has to be in the same namespace as the Policy.

How should I approuch it?

Steps to reproduce

Install ImageUpdateAutomation and ImagePolicy

Expected behavior

A flag for cluster-wide namespace watch.

Screenshots and recordings

No response

OS / Distro

EKS newest

Flux version

v2.1.2

Flux check

► checking prerequisites
✔ Kubernetes 1.28.3-eks-4f4795d >=1.25.0-0
► checking controllers
✔ helm-controller: deployment ready
► ghcr.io/fluxcd/helm-controller:v0.36.2
✔ image-automation-controller: deployment ready
► ghcr.io/fluxcd/image-automation-controller:v0.36.1
✔ image-reflector-controller: deployment ready
► ghcr.io/fluxcd/image-reflector-controller:v0.30.0
✔ kustomize-controller: deployment ready
► ghcr.io/fluxcd/kustomize-controller:v1.1.1
✔ notification-controller: deployment ready
► ghcr.io/fluxcd/notification-controller:v1.1.0
✔ source-controller: deployment ready
► ghcr.io/fluxcd/source-controller:v1.1.2
► checking crds
✔ alerts.notification.toolkit.fluxcd.io/v1beta2
✔ buckets.source.toolkit.fluxcd.io/v1beta2
✔ gitrepositories.source.toolkit.fluxcd.io/v1
✔ helmcharts.source.toolkit.fluxcd.io/v1beta2
✔ helmreleases.helm.toolkit.fluxcd.io/v2beta1
✔ helmrepositories.source.toolkit.fluxcd.io/v1beta2
✔ imagepolicies.image.toolkit.fluxcd.io/v1beta2
✔ imagerepositories.image.toolkit.fluxcd.io/v1beta2
✔ imageupdateautomations.image.toolkit.fluxcd.io/v1beta1
✔ kustomizations.kustomize.toolkit.fluxcd.io/v1
✔ ocirepositories.source.toolkit.fluxcd.io/v1beta2
✔ providers.notification.toolkit.fluxcd.io/v1beta2
✔ receivers.notification.toolkit.fluxcd.io/v1
✔ all checks passed

Git provider

No response

Container Registry provider

No response

Additional context

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[makkes]

This is pretty much answered in Stefan's comment here.