From 10bcd89beceb92bab62f6720f167b8e9adde3c6a Mon Sep 17 00:00:00 2001 From: Ofer Kozokaro Date: Tue, 23 Jun 2026 18:44:10 -0300 Subject: [PATCH] deps(images): pin floating :latest container image tags Pin the three images that used :latest so deployments are reproducible: - oauth2-proxy: quay.io/oauth2-proxy/oauth2-proxy:latest -> v7.15.3 - ARC runner: summerwind/actions-runner:latest -> v2.335.1-ubuntu-24.04 - velero wait Job: registry.hub.docker.com/bitnami/kubectl:latest -> rancher/kubectl:v1.33.12. Bitnami's free Docker Hub catalog was deprecated and its versioned kubectl tags now 404, so this switches to the maintained rancher/kubectl image pinned to the 1.33 cluster line. --- .../core-services/components/oauth2-proxy/oauth2-proxy.yaml | 2 +- .../runners/github/actions-runner-controller/application.yaml | 2 +- .../cc-cluster/core-services/components/velero/core/wait.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/oauth2-proxy/oauth2-proxy.yaml b/platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/oauth2-proxy/oauth2-proxy.yaml index 26ee632e..e21044b1 100644 --- a/platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/oauth2-proxy/oauth2-proxy.yaml +++ b/platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/oauth2-proxy/oauth2-proxy.yaml @@ -37,7 +37,7 @@ spec: secretKeyRef: name: oauth2-proxy-secrets key: cookie-secret - image: quay.io/oauth2-proxy/oauth2-proxy:latest + image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3 imagePullPolicy: Always name: oauth2-proxy ports: diff --git a/platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/runners/github/actions-runner-controller/application.yaml b/platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/runners/github/actions-runner-controller/application.yaml index d8a5e9b2..f2cf767b 100644 --- a/platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/runners/github/actions-runner-controller/application.yaml +++ b/platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/runners/github/actions-runner-controller/application.yaml @@ -33,7 +33,7 @@ spec: dockerRegistryMirror: "" image: repository: "summerwind/actions-runner-controller" - actionsRunnerRepositoryAndTag: "summerwind/actions-runner:latest" + actionsRunnerRepositoryAndTag: "summerwind/actions-runner:v2.335.1-ubuntu-24.04" dindSidecarRepositoryAndTag: "docker:dind" pullPolicy: IfNotPresent # The default image-pull secrets name for self-hosted runner container. diff --git a/platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/velero/core/wait.yaml b/platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/velero/core/wait.yaml index 5958ebd1..8c4591ef 100644 --- a/platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/velero/core/wait.yaml +++ b/platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/velero/core/wait.yaml @@ -41,7 +41,7 @@ spec: serviceAccountName: k8s-toolkit-velero-wait containers: - name: wait - image: registry.hub.docker.com/bitnami/kubectl:latest + image: rancher/kubectl:v1.33.12 imagePullPolicy: IfNotPresent args: - "rollout"