feat(api): support pinning image tags and digests#989
Open
przadzinski wants to merge 1 commit into
Open
Conversation
Add optional `imageTag` and `imageDigest` fields to the server (`spec`), UI (`spec.ui`) and admin tools (`spec.admintools`) specs. Until now every image was deployed as `<image>:<version>`, which couples the deployed tag to the cluster version (which also drives the persistence schema migrations) and leaves the running image on a mutable tag. - `imageTag` overrides the tag used for the image, falling back to `version` when unset. This addresses the long-standing request in alexandrevilain#788 / alexandrevilain#789 to decouple the admin-tools/ui/server image tag from the Temporal version. - `imageDigest` pins the image to an immutable digest, appended as `<image>:<tag>@<digest>`, so the running image cannot change behind a mutable tag (image provenance / supply-chain hardening). CRD validation enforces the `sha256:<64 hex>` format. Both fields are optional and backwards-compatible; when unset the image reference is unchanged. Image construction is centralised in a new `meta.ContainerImage` helper used by all four builders (server, ui, admintools deployment and the schema-setup job) to avoid duplication. For the server, `version` still drives the persistence schema version regardless of these overrides — only the deployed image reference changes. Refs alexandrevilain#788, alexandrevilain#789 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Patryk Rzadzinski <patryk@rzski.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds two optional fields —
imageTagandimageDigest— to the server (spec), UI (spec.ui) and admin-tools (spec.admintools) specs, so the deployed image reference can be decoupled fromversionand pinned immutably.imageTagimageDigestimage:version(unchanged)image:imageTagimage:version@digestimage:imageTag@digestBoth are optional and fully backwards-compatible — when unset, the reference is exactly as today.
Why
Two long-standing needs, addressed by one small change:
imageTag— decouples the image tag fromversion. This is the request in Allow overriding admintools image tag #788 / Add tag config for server/ui/admintools images #789 (admin-tools/UI/server images are sometimes published under tags that don't match the Temporal version, which currently blocks deployment). @alexandrevilain — on Add tag config for server/ui/admintools images #789 you said you were happy to merge this direction once rebased with docs; that PR went stale, so this revisits it.imageDigest— pins the image to an immutable digest (<image>:<tag>@<digest>) so the running image can't change behind a mutable tag. This is important for supply-chain / image-provenance requirements (e.g. PCI-DSS image pinning), where a semver tag alone isn't sufficient. The semverversionfield can't hold a digest and still drives schema migrations, so a separate field is the natural fit.How
meta.ContainerImage(repository, defaultTag, tagOverride, digest)helper, used by all four call sites (server, UI, admin-tools deployment, and the schema-setup job) — no duplicated logic.versionstill drives the persistence schema version regardless of these overrides; only the deployed image reference changes.^sha256:[a-fA-F0-9]{64}$digest format.Included
config/crd/bases) and api-docs (docs/api/v1beta1.md) via the pinnedcontroller-gen v0.16.3internal/resource/meta/image_test.go)docs/features/image-pinning.md) + nav entrymake manifests generate,go vet,gofmtand the new test all pass. Deepcopy required no change (plain string fields). The release-time helm-chart CRD (charts/.../temporal-operator.crds.yaml) is regenerated duringreleaseper the Makefile, so I left it untouched — happy to include it if you'd prefer.Refs #788, #789