feat: automatic image updates via OCI registry digest polling

api/v1alpha1/paperclipinstance_types.go

@@ -155,6 +155,24 @@ type ImageSpec struct {
 	// PullSecrets specifies image pull secrets.
 	// +optional
 	PullSecrets []corev1.LocalObjectReference `json:"pullSecrets,omitempty"`
+
+	// AutoUpdate enables automatic image updates by polling the registry for new digests.
+	// +optional
+	AutoUpdate *AutoUpdateSpec `json:"autoUpdate,omitempty"`
+}
+
+// AutoUpdateSpec configures automatic image update polling.
+type AutoUpdateSpec struct {
+	// Enabled controls whether auto-update polling is active.
+	// +kubebuilder:default=false
+	// +optional
+	Enabled bool `json:"enabled,omitempty"`
+
+	// Interval is the polling interval (e.g. "5m", "1h"). Minimum is 1m.
+	// +kubebuilder:default="5m"
+	// +kubebuilder:validation:Pattern=`^\d+(s|m|h)$`
+	// +optional
+	Interval string `json:"interval,omitempty"`
 }
 
 // DeploymentSpec controls deployment mode and exposure.
@@ -727,6 +745,10 @@ type InstanceStatus struct {
 	// Restore tracks the state of the latest restore operation.
 	// +optional
 	Restore *RestoreStatus `json:"restore,omitempty"`
+
+	// AutoUpdate tracks the state of automatic image update checks.
+	// +optional
+	AutoUpdate *AutoUpdateStatus `json:"autoUpdate,omitempty"`
 }
 
 // ManagedResources tracks the names of managed Kubernetes resources.
@@ -775,6 +797,25 @@ type RestoreStatus struct {
 	Result string `json:"result,omitempty"`
 }
 
+// AutoUpdateStatus tracks the state of automatic image update checks.
+type AutoUpdateStatus struct {
+	// LastCheckTime is when the operator last queried the registry.
+	// +optional
+	LastCheckTime *metav1.Time `json:"lastCheckTime,omitempty"`
+
+	// ResolvedDigest is the most recently observed digest for the configured tag.
+	// +optional
+	ResolvedDigest string `json:"resolvedDigest,omitempty"`
+
+	// LastUpdateTime is when the digest last changed and a rollout was triggered.
+	// +optional
+	LastUpdateTime *metav1.Time `json:"lastUpdateTime,omitempty"`
+
+	// LastError records the most recent error from a registry check, if any.
+	// +optional
+	LastError string `json:"lastError,omitempty"`
+}
+
 // +kubebuilder:object:root=true
 // +kubebuilder:subresource:status
 // +kubebuilder:resource:shortName=pci

charts/paperclip-operator/templates/crds/paperclip.inc_instances.yaml

@@ -3636,6 +3636,22 @@ spec:
               image:
                 description: Image specifies the Paperclip container image to deploy.
                 properties:
+                  autoUpdate:
+                    description: AutoUpdate enables automatic image updates by polling
+                      the registry for new digests.
+                    properties:
+                      enabled:
+                        default: false
+                        description: Enabled controls whether auto-update polling
+                          is active.
+                        type: boolean
+                      interval:
+                        default: 5m
+                        description: Interval is the polling interval (e.g. "5m",
+                          "1h"). Minimum is 1m.
+                        pattern: ^\d+(s|m|h)$
+                        type: string
+                    type: object
                   digest:
                     description: Digest overrides the tag with an image digest (e.g.
                       sha256:abc...).
@@ -7410,6 +7426,29 @@ spec:
           status:
             description: InstanceStatus defines the observed state of Instance.
             properties:
+              autoUpdate:
+                description: AutoUpdate tracks the state of automatic image update
+                  checks.
+                properties:
+                  lastCheckTime:
+                    description: LastCheckTime is when the operator last queried the
+                      registry.
+                    format: date-time
+                    type: string
+                  lastError:
+                    description: LastError records the most recent error from a registry
+                      check, if any.
+                    type: string
+                  lastUpdateTime:
+                    description: LastUpdateTime is when the digest last changed and
+                      a rollout was triggered.
+                    format: date-time
+                    type: string
+                  resolvedDigest:
+                    description: ResolvedDigest is the most recently observed digest
+                      for the configured tag.
+                    type: string
+                type: object
               backup:
                 description: Backup tracks the state of the latest backup operation.
                 properties:

cmd/main.go

@@ -39,6 +39,7 @@ import (
 
 	paperclipv1alpha1 "github.com/paperclipinc/paperclip-operator/api/v1alpha1"
 	"github.com/paperclipinc/paperclip-operator/internal/controller"
+	"github.com/paperclipinc/paperclip-operator/internal/registry"
 	// +kubebuilder:scaffold:imports
 )
 
@@ -203,9 +204,10 @@ func main() {
 	}
 
 	if err := (&controller.InstanceReconciler{
-		Client:   mgr.GetClient(),
-		Scheme:   mgr.GetScheme(),
-		Recorder: mgr.GetEventRecorderFor("paperclip-operator"),
+		Client:         mgr.GetClient(),
+		Scheme:         mgr.GetScheme(),
+		Recorder:       mgr.GetEventRecorderFor("paperclip-operator"),
+		RegistryClient: registry.NewClient(nil),
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "Instance")
 		os.Exit(1)

config/crd/bases/paperclip.inc_instances.yaml

@@ -3630,6 +3630,22 @@ spec:
               image:
                 description: Image specifies the Paperclip container image to deploy.
                 properties:
+                  autoUpdate:
+                    description: AutoUpdate enables automatic image updates by polling
+                      the registry for new digests.
+                    properties:
+                      enabled:
+                        default: false
+                        description: Enabled controls whether auto-update polling
+                          is active.
+                        type: boolean
+                      interval:
+                        default: 5m
+                        description: Interval is the polling interval (e.g. "5m",
+                          "1h"). Minimum is 1m.
+                        pattern: ^\d+(s|m|h)$
+                        type: string
+                    type: object
                   digest:
                     description: Digest overrides the tag with an image digest (e.g.
                       sha256:abc...).
@@ -7404,6 +7420,29 @@ spec:
           status:
             description: InstanceStatus defines the observed state of Instance.
             properties:
+              autoUpdate:
+                description: AutoUpdate tracks the state of automatic image update
+                  checks.
+                properties:
+                  lastCheckTime:
+                    description: LastCheckTime is when the operator last queried the
+                      registry.
+                    format: date-time
+                    type: string
+                  lastError:
+                    description: LastError records the most recent error from a registry
+                      check, if any.
+                    type: string
+                  lastUpdateTime:
+                    description: LastUpdateTime is when the digest last changed and
+                      a rollout was triggered.
+                    format: date-time
+                    type: string
+                  resolvedDigest:
+                    description: ResolvedDigest is the most recently observed digest
+                      for the configured tag.
+                    type: string
+                type: object
               backup:
                 description: Backup tracks the state of the latest backup operation.
                 properties: