How to do a simultaneous image and configuration update with image policy

[Legion2]

We use Image Automation and defined an image policy to track a specific version of our app. To rollout a breaking configuration change, the new image is tagged with a new major version, so it is not included in the semver range of the image policy. Then we update the deployment config, image version tag and image policy semver range in the same commit and push it to our infrastructure git repo.

At first this works fine, however shortly after the new version is deployed, flux makes an image update and downgrades to the old image version which is not included in the semver range of the image policy anymore! This breaks our application, because the old image does not work with the new deployment configuration. After some time flux updates the image again to the new image version.

How can we ensure flux does not downgrade our image versions during critical updates with configuration changes?