Dependabot-like workflow for container image automation

[sa-spag]

👋 Hello,

As discussed on Slack, it could be handy to be able to achieve a Dependabot-like workflow for container image automation. The goal is to have pull requests acting as a manual gate for delivery.

This document describes a setup which is close, but since ImageUpdateAutomation's push spec only allows a statically-named branch to be specified, it seems it is not currently doable. In fact, as a single ImageUpdateAutomation applies to a whole namespace, pull requests created from Flux's owned branches could include unrelated changes, making them kind of unusable.

A set of solutions implies generating branch names (e.g. based on the updated manifest path, a random hash, etc.) instead of specifying a known branch name.

[iainmcgin]

A more recent related discussion: #3135

[sa-spag]

Such workflow is achievable with Argo CD Image Updater, which allows target branch name templates (see the documentation), e.g. by annotating Argo CD Applications with:

argocd-image-updater.argoproj.io/git-branch: :image-updater-{{.SHA256}}