Automated - Update component image digests - #6337
Open
aro-hcp-robot[bot] wants to merge 3 commits into
Open
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: aro-hcp-robot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Updates pinned container image digests across dev environment rendered configs and ACM/MCE Helm charts to roll forward operator bundles and component images.
Changes:
- Bump ACM/MCE operator bundle digests across dev rendered configs and Helm chart metadata.
- Update pinned digests/SHAs for hypershift operator, oc-mirror, maestro sidecar nginx, and thanos images in defaults and rendered env configs.
- Refresh selected MCE operand image digests in the multicluster-engine operator deployment template.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| config/rendered/dev/pers/westus3.yaml | Updates image digests/SHAs for ACM/MCE bundles and core components in pers westus3 rendered config. |
| config/rendered/dev/perf/westus3.yaml | Updates image digests/SHAs for ACM/MCE bundles and core components in perf westus3 rendered config. |
| config/rendered/dev/dev/westus3.yaml | Updates image digests/SHAs for ACM/MCE bundles and core components in dev westus3 rendered config. |
| config/rendered/dev/cspr/westus3.yaml | Updates image digests/SHAs for ACM/MCE bundles and core components in cspr westus3 rendered config. |
| config/rendered/dev/ci01/centralus.yaml | Updates image digests/SHAs for ACM/MCE bundles and core components in ci01 centralus rendered config. |
| config/rendered/dev/ci00/centralus.yaml | Updates image digests/SHAs for ACM/MCE bundles and core components in ci00 centralus rendered config. |
| config/config.yaml | Updates defaults for hypershift, thanos, maestro sidecar nginx, ACM/MCE bundles, and oc-mirror digests/SHAs. |
| acm/deploy/helm/multicluster-engine/templates/multicluster-engine-operator.deployment.yaml | Updates a couple of operand image digests used by the operator deployment. |
| acm/deploy/helm/multicluster-engine/Chart.yaml | Updates chart source reference to the new MCE bundle digest. |
| acm/deploy/helm/multicluster-engine-crds/Chart.yaml | Updates chart source reference to the new MCE bundle digest. |
| acm/deploy/helm/multicluster-engine-config/charts/policy/values.yaml | Updates governance policy framework addon image digest. |
Comments suppressed due to low confidence (1)
config/rendered/dev/dev/westus3.yaml:1
- Rendered configs still show
tag: v0.41.0with the updatedsha. Ifshais intended to correspond to a different release (as suggested by the defaults comment inconfig/config.yaml), the rendered output should be regenerated after fixing the tag/SHA alignment in the source defaults, so that all environments consistently reference the intended thanos version.
acm:
Comment on lines
609
to
+612
| registry: arohcpsvcdev.azurecr.io | ||
| repository: thanos/thanos | ||
| tag: v0.41.0 | ||
| sha: 6249f7aaadd3695df637fb2eb4cb9a9955611eee691c3970892fe9c0dc3f2db6 # v0.42.2 (2026-07-16 20:22) | ||
| sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37) |
Comment on lines
740
to
+743
| registry: arohcpsvcdev.azurecr.io | ||
| repository: thanos/thanos | ||
| tag: v0.41.0 | ||
| sha: 6249f7aaadd3695df637fb2eb4cb9a9955611eee691c3970892fe9c0dc3f2db6 # v0.42.2 (2026-07-16 20:22) | ||
| sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37) |
Comment on lines
1062
to
+1065
| image: | ||
| registry: arohcpsvcdev.azurecr.io | ||
| repository: thanos/thanos | ||
| sha: 6249f7aaadd3695df637fb2eb4cb9a9955611eee691c3970892fe9c0dc3f2db6 | ||
| sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 |
| repository: thanos/thanos | ||
| sha: 6249f7aaadd3695df637fb2eb4cb9a9955611eee691c3970892fe9c0dc3f2db6 | ||
| sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 | ||
| tag: v0.41.0 |
aro-hcp-robot
Bot
force-pushed
the
automated---update-component-image-digests
branch
from
July 30, 2026 22:34
06c206b to
003e0b3
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (3)
config/config.yaml:612
- The
tagvalue (v0.41.0) conflicts with the SHA comment indicatingv0.42.4. If the rendering/deployment logic usestag(even as a fallback), this can deploy a different version than intended or confuse operators during incident/debugging. Recommendation: aligntagwith the version implied by the pinned SHA (or update the SHA/comment to matchv0.41.0) so the human-readable tag and pinned digest represent the same release. (Same issue appears again in the laterdefaultsthanos image section.)
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
acm/deploy/helm/multicluster-engine/templates/multicluster-engine-operator.deployment.yaml:137
- The backplane operator image digest is duplicated in two places (env var and container
image). This makes future bumps error-prone (easy to update one and miss the other). Recommendation: define this image reference once (e.g., invalues.yamlunder a single key or a named template helper) and reference it from both locations.
value: '{{ .Values.imageRegistry }}/{{ .Values.imageRootRepository }}/backplane-rhel9-operator@sha256:1c59e0a1ed54e8480bbe7e84c271e55cc600391530791412e7eeee9d6444abfa'
acm/deploy/helm/multicluster-engine/templates/multicluster-engine-operator.deployment.yaml:142
- The backplane operator image digest is duplicated in two places (env var and container
image). This makes future bumps error-prone (easy to update one and miss the other). Recommendation: define this image reference once (e.g., invalues.yamlunder a single key or a named template helper) and reference it from both locations.
image: '{{ .Values.imageRegistry }}/{{ .Values.imageRootRepository }}/backplane-rhel9-operator@sha256:1c59e0a1ed54e8480bbe7e84c271e55cc600391530791412e7eeee9d6444abfa'
Contributor
aro-hcp-robot
Bot
force-pushed
the
automated---update-component-image-digests
branch
from
July 31, 2026 06:36
003e0b3 to
4245da1
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.
Suppressed comments (2)
config/config.yaml:612
- The Thanos image metadata is internally inconsistent:
tag: v0.41.0while theshacomment indicatesv0.42.4. If your image reference is constructed using both tag + sha, this can resolve to an unexpected image (or fail validation if you enforce tag/sha pairing). Align these fields by either updating the tag to match the referenced version, or updating the sha/comment to matchv0.41.0.
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
config/config.yaml:743
- The Thanos image metadata is internally inconsistent:
tag: v0.41.0while theshacomment indicatesv0.42.4. If your image reference is constructed using both tag + sha, this can resolve to an unexpected image (or fail validation if you enforce tag/sha pairing). Align these fields by either updating the tag to match the referenced version, or updating the sha/comment to matchv0.41.0.
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
aro-hcp-robot
Bot
force-pushed
the
automated---update-component-image-digests
branch
from
July 31, 2026 14:32
4245da1 to
d664018
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.
Suppressed comments (2)
config/config.yaml:612
- The thanos image fields are inconsistent:
tagisv0.41.0while theshacomment indicatesv0.42.4. If both fields are used to select/build the image, this can result in deploying an unexpected version. Align the tag with the referenced version (or update the sha/comment to match the tag).
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
config/config.yaml:743
- Same inconsistency in the second thanos block:
tag: v0.41.0but sha comment saysv0.42.4. Align these to avoid confusion and potential version skew.
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
Comment on lines
9
to
12
| sources: | ||
| - quay.io/redhat-user-workloads/crt-redhat-acm-tenant/mce-operator-bundle-mce-211@sha256:c8b9aa2f3e0d3db6c11974c2ae820dab5cf3c290f7de8b5115e1839e0a8aab1d | ||
| - quay.io/redhat-user-workloads/crt-redhat-acm-tenant/mce-operator-bundle-mce-211@sha256:80c9c12c8f47f5e94f6129487346379e9b3dce7cae710c3eb1e34914577dc374 | ||
| type: application | ||
| version: 2.11.4 |
Comment on lines
9
to
12
| sources: | ||
| - quay.io/redhat-user-workloads/crt-redhat-acm-tenant/mce-operator-bundle-mce-211@sha256:c8b9aa2f3e0d3db6c11974c2ae820dab5cf3c290f7de8b5115e1839e0a8aab1d | ||
| - quay.io/redhat-user-workloads/crt-redhat-acm-tenant/mce-operator-bundle-mce-211@sha256:80c9c12c8f47f5e94f6129487346379e9b3dce7cae710c3eb1e34914577dc374 | ||
| type: application | ||
| version: 2.11.4 |
Contributor
chore: render digests using materialize
aro-hcp-robot
Bot
force-pushed
the
automated---update-component-image-digests
branch
from
July 31, 2026 22:32
d664018 to
0dfcae7
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.
Suppressed comments (3)
config/config.yaml:615
- The Thanos
tagremainsv0.41.0while theshacomment indicatesv0.42.4. Even if your tooling uses the digest/sha as the source of truth, this mismatch is confusing and can lead to incorrect assumptions during incident response or upgrades. Please align the tag (and/or the comment) with the pinned digest so they describe the same version.
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
config/config.yaml:747
- The Thanos
tagremainsv0.41.0while theshacomment indicatesv0.42.4. Even if your tooling uses the digest/sha as the source of truth, this mismatch is confusing and can lead to incorrect assumptions during incident response or upgrades. Please align the tag (and/or the comment) with the pinned digest so they describe the same version.
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
acm/deploy/helm/multicluster-engine/templates/multicluster-engine-operator.deployment.yaml:175
- This changes scheduling semantics from a preferred placement on infra nodes (via
preferredDuringSchedulingIgnoredDuringExecution) to a hard requirement (vianodeSelector). If any cluster/environment lacks nodes labeledaro-hcp.azure.com/role: infra, the operator will become unschedulable and remain Pending. If the intent is still 'prefer infra but allow fallback', consider restoring preferred nodeAffinity; if the intent is 'infra-only', consider making this behavior configurable via values so other environments can opt out safely.
nodeSelector:
aro-hcp.azure.com/role: infra
Comment on lines
9
to
+10
| sources: | ||
| - quay.io/redhat-user-workloads/crt-redhat-acm-tenant/mce-operator-bundle-mce-211@sha256:c8b9aa2f3e0d3db6c11974c2ae820dab5cf3c290f7de8b5115e1839e0a8aab1d | ||
| - quay.io/redhat-user-workloads/crt-redhat-acm-tenant/mce-operator-bundle-mce-211@sha256:07a34fcadced16168de23d3a53993fae84c3083c390658760b33f1d5f6c5dded |
Comment on lines
9
to
+10
| sources: | ||
| - quay.io/redhat-user-workloads/crt-redhat-acm-tenant/mce-operator-bundle-mce-211@sha256:c8b9aa2f3e0d3db6c11974c2ae820dab5cf3c290f7de8b5115e1839e0a8aab1d | ||
| - quay.io/redhat-user-workloads/crt-redhat-acm-tenant/mce-operator-bundle-mce-211@sha256:07a34fcadced16168de23d3a53993fae84c3083c390658760b33f1d5f6c5dded |
Collaborator
|
/test e2e-parallel |
Contributor
Contributor
Contributor
|
@aro-hcp-robot[bot]: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Contributor
|
/hold Revision 0dfcae7 was retested 3 times: holding |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This automated PR updates ARO-HCP container image digests to the latest versions from registries.
Schedule: Monday through Friday at 2 AM UTC
Generated by: periodic-ci-Azure-ARO-HCP-main-image-updater-tooling
Generated at: 2026-07-31T22:32:06+0000