Flux ImageUpdateAutomation "unable to push" write-credentials error in CI

image-automation-controller updated the image tag in the manifests and tried to push the commit to the GitRepository, but the push was rejected. The git secret has read-only access, while image automation needs write access to push commits.

What this error means

An ImageUpdateAutomation reports "False" with an "unable to push" or "authentication required" error when committing the updated tag back to the repo.

unable to push to remote: authentication required

Common causes

The git secret is read-only

The GitRepository secret has enough scope to clone but not to push, so image automation cannot write the tag-bump commit.

The deploy key lacks write access

An SSH deploy key registered without write access lets the source clone but rejects the push from image automation.

How to fix it

Grant the credentials write access

1. Give the token or deploy key write access to the repository.
2. Confirm spec.git.push.branch targets a branch the credentials can push to.
3. Reconcile the image automation and confirm the commit lands.

flux reconcile image update flux-system
kubectl -n flux-system describe imageupdateautomation flux-system

Use a write-enabled deploy key

Recreate the git secret with a key registered for write access so image automation can push.

flux create secret git flux-system \
  --url=ssh://git@github.com/acme/infra \
  --ssh-key-algorithm=ecdsa

How to prevent it

• Give image automation git credentials write scope, not just read.
• Register the deploy key with write access when using SSH.
• Push tag bumps to a branch the automation credentials can write.

Related guides