From 865a9b5a553efe219f54400f2aa406ddee414af4 Mon Sep 17 00:00:00 2001 From: Lucas Mundim Date: Sat, 6 Jun 2026 17:47:20 -0300 Subject: [PATCH] fix(chart): claimer falls through to image.tag when its own tag is unset MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hoists the load-bearing piece of #62 (DT-164) so the drift hole closes before gitops#130 (ArgoCD Image Updater) reconciles in clusters. Today both `image.tag` and `claimerImage.tag` carry `$imagepolicy` markers and image-policy-applier bumps both — controller and claimer stay in lockstep. Once gitops#130 lands, Image Updater takes over and only rewrites `image.tag` (the `image-list` annotation covers `openfilter-pipelines-controller`, not the claimer). `claimerImage.tag` would freeze at its last set value while the controller advances, silently drifting until the next claimer-side flag or API change makes the gap user-visible. Fix: - `templates/deployment.yaml:121` — `CLAIMER_IMAGE` rendering gains a `default .Values.image.tag` fallback so the claimer follows the controller's tag whenever its own is unset. `Chart.AppVersion` stays as the last-resort floor for fresh installs. - 4 overrides drop the static `claimerImage.tag: ` line (with the `$imagepolicy` marker). `claimerImage.repository: plainsightai/*` stays — that's the post-#71 Docker Hub path. With no `tag:` set, the template's fallback chain takes over. Validated by `helm template` against `overrides/production.yaml`: `CLAIMER_IMAGE=plainsightai/openfilter-pipelines-claimer:` as expected. Cross-refs: #71 (Docker Hub publish that introduced the drift hole), #62 (Sam's larger DT-164 refactor that originally bundled this fix), gitops#130 (the Image Updater rollout this guards against). --- .../overrides/development.yaml | 1 - .../openfilter-pipelines-controller/overrides/lab.yaml | 1 - .../overrides/production.yaml | 1 - .../openfilter-pipelines-controller/overrides/staging.yaml | 1 - .../templates/deployment.yaml | 7 ++++++- 5 files changed, 6 insertions(+), 5 deletions(-) diff --git a/deployment/openfilter-pipelines-controller/overrides/development.yaml b/deployment/openfilter-pipelines-controller/overrides/development.yaml index b5cd05f..f015882 100644 --- a/deployment/openfilter-pipelines-controller/overrides/development.yaml +++ b/deployment/openfilter-pipelines-controller/overrides/development.yaml @@ -3,7 +3,6 @@ image: tag: "fe613cc832bc53753274fb6e1a178dd8d00d2c33" # {"$imagepolicy": "development:openfilter-pipelines-controller:tag"} claimerImage: repository: plainsightai/openfilter-pipelines-claimer - tag: "fe613cc832bc53753274fb6e1a178dd8d00d2c33" # {"$imagepolicy": "development:openfilter-pipelines-controller:tag"} telemetry: exporterType: otlp # Scheme prefix is load-bearing. openfilter ≥ 0.2.1 infers OTLP gRPC TLS diff --git a/deployment/openfilter-pipelines-controller/overrides/lab.yaml b/deployment/openfilter-pipelines-controller/overrides/lab.yaml index 70bb54d..12a5f6e 100644 --- a/deployment/openfilter-pipelines-controller/overrides/lab.yaml +++ b/deployment/openfilter-pipelines-controller/overrides/lab.yaml @@ -3,7 +3,6 @@ image: tag: "fe613cc832bc53753274fb6e1a178dd8d00d2c33" # {"$imagepolicy": "lab:openfilter-pipelines-controller:tag"} claimerImage: repository: plainsightai/openfilter-pipelines-claimer - tag: "fe613cc832bc53753274fb6e1a178dd8d00d2c33" # {"$imagepolicy": "lab:openfilter-pipelines-controller:tag"} telemetry: # Lab has no monitoring overlay (no controllers/monitoring/overrides/lab.yaml), # so opt out of the base.yaml OTLP export to avoid filter pods retrying diff --git a/deployment/openfilter-pipelines-controller/overrides/production.yaml b/deployment/openfilter-pipelines-controller/overrides/production.yaml index a2bfb2b..6d1c515 100644 --- a/deployment/openfilter-pipelines-controller/overrides/production.yaml +++ b/deployment/openfilter-pipelines-controller/overrides/production.yaml @@ -3,7 +3,6 @@ image: tag: "fe613cc832bc53753274fb6e1a178dd8d00d2c33" # {"$imagepolicy": "production:openfilter-pipelines-controller:tag"} claimerImage: repository: plainsightai/openfilter-pipelines-claimer - tag: "fe613cc832bc53753274fb6e1a178dd8d00d2c33" # {"$imagepolicy": "production:openfilter-pipelines-controller:tag"} resources: requests: cpu: "100m" diff --git a/deployment/openfilter-pipelines-controller/overrides/staging.yaml b/deployment/openfilter-pipelines-controller/overrides/staging.yaml index 740074d..89ab427 100644 --- a/deployment/openfilter-pipelines-controller/overrides/staging.yaml +++ b/deployment/openfilter-pipelines-controller/overrides/staging.yaml @@ -3,7 +3,6 @@ image: tag: "fe613cc832bc53753274fb6e1a178dd8d00d2c33" # {"$imagepolicy": "staging:openfilter-pipelines-controller:tag"} claimerImage: repository: plainsightai/openfilter-pipelines-claimer - tag: "fe613cc832bc53753274fb6e1a178dd8d00d2c33" # {"$imagepolicy": "staging:openfilter-pipelines-controller:tag"} telemetry: exporterType: otlp # Scheme prefix is load-bearing. openfilter ≥ 0.2.1 infers OTLP gRPC TLS diff --git a/deployment/openfilter-pipelines-controller/templates/deployment.yaml b/deployment/openfilter-pipelines-controller/templates/deployment.yaml index d8d2a83..1058237 100644 --- a/deployment/openfilter-pipelines-controller/templates/deployment.yaml +++ b/deployment/openfilter-pipelines-controller/templates/deployment.yaml @@ -118,7 +118,12 @@ spec: {{- end }} {{- end }} - name: CLAIMER_IMAGE - value: "{{ .Values.claimerImage.repository }}:{{ .Values.claimerImage.tag | default .Chart.AppVersion }}" + # Fall through to image.tag when claimerImage.tag is unset so + # ArgoCD Image Updater (which only rewrites image.tag from the + # gitops `image-list` annotation) keeps the controller + claimer + # in lockstep. AppVersion is the last-resort floor for fresh + # installs that haven't been bumped yet. + value: "{{ .Values.claimerImage.repository }}:{{ .Values.claimerImage.tag | default .Values.image.tag | default .Chart.AppVersion }}" {{- if .Values.gpuNodeSelector }} - name: GPU_NODE_SELECTOR value: {{ .Values.gpuNodeSelector | quote }}