Automated - Update component image digests - #6337
Conversation
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Updates pinned container image digests across dev environment rendered configs and ACM/MCE Helm charts to roll forward operator bundles and component images.
Changes:
- Bump ACM/MCE operator bundle digests across dev rendered configs and Helm chart metadata.
- Update pinned digests/SHAs for hypershift operator, oc-mirror, maestro sidecar nginx, and thanos images in defaults and rendered env configs.
- Refresh selected MCE operand image digests in the multicluster-engine operator deployment template.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| config/rendered/dev/pers/westus3.yaml | Updates image digests/SHAs for ACM/MCE bundles and core components in pers westus3 rendered config. |
| config/rendered/dev/perf/westus3.yaml | Updates image digests/SHAs for ACM/MCE bundles and core components in perf westus3 rendered config. |
| config/rendered/dev/dev/westus3.yaml | Updates image digests/SHAs for ACM/MCE bundles and core components in dev westus3 rendered config. |
| config/rendered/dev/cspr/westus3.yaml | Updates image digests/SHAs for ACM/MCE bundles and core components in cspr westus3 rendered config. |
| config/rendered/dev/ci01/centralus.yaml | Updates image digests/SHAs for ACM/MCE bundles and core components in ci01 centralus rendered config. |
| config/rendered/dev/ci00/centralus.yaml | Updates image digests/SHAs for ACM/MCE bundles and core components in ci00 centralus rendered config. |
| config/config.yaml | Updates defaults for hypershift, thanos, maestro sidecar nginx, ACM/MCE bundles, and oc-mirror digests/SHAs. |
| acm/deploy/helm/multicluster-engine/templates/multicluster-engine-operator.deployment.yaml | Updates a couple of operand image digests used by the operator deployment. |
| acm/deploy/helm/multicluster-engine/Chart.yaml | Updates chart source reference to the new MCE bundle digest. |
| acm/deploy/helm/multicluster-engine-crds/Chart.yaml | Updates chart source reference to the new MCE bundle digest. |
| acm/deploy/helm/multicluster-engine-config/charts/policy/values.yaml | Updates governance policy framework addon image digest. |
Comments suppressed due to low confidence (1)
config/rendered/dev/dev/westus3.yaml:1
- Rendered configs still show
tag: v0.41.0with the updatedsha. Ifshais intended to correspond to a different release (as suggested by the defaults comment inconfig/config.yaml), the rendered output should be regenerated after fixing the tag/SHA alignment in the source defaults, so that all environments consistently reference the intended thanos version.
acm:
| registry: arohcpsvcdev.azurecr.io | ||
| repository: thanos/thanos | ||
| tag: v0.41.0 | ||
| sha: 6249f7aaadd3695df637fb2eb4cb9a9955611eee691c3970892fe9c0dc3f2db6 # v0.42.2 (2026-07-16 20:22) | ||
| sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37) |
| registry: arohcpsvcdev.azurecr.io | ||
| repository: thanos/thanos | ||
| tag: v0.41.0 | ||
| sha: 6249f7aaadd3695df637fb2eb4cb9a9955611eee691c3970892fe9c0dc3f2db6 # v0.42.2 (2026-07-16 20:22) | ||
| sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37) |
| image: | ||
| registry: arohcpsvcdev.azurecr.io | ||
| repository: thanos/thanos | ||
| sha: 6249f7aaadd3695df637fb2eb4cb9a9955611eee691c3970892fe9c0dc3f2db6 | ||
| sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 |
| repository: thanos/thanos | ||
| sha: 6249f7aaadd3695df637fb2eb4cb9a9955611eee691c3970892fe9c0dc3f2db6 | ||
| sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 | ||
| tag: v0.41.0 |
06c206b to
003e0b3
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (3)
config/config.yaml:612
- The
tagvalue (v0.41.0) conflicts with the SHA comment indicatingv0.42.4. If the rendering/deployment logic usestag(even as a fallback), this can deploy a different version than intended or confuse operators during incident/debugging. Recommendation: aligntagwith the version implied by the pinned SHA (or update the SHA/comment to matchv0.41.0) so the human-readable tag and pinned digest represent the same release. (Same issue appears again in the laterdefaultsthanos image section.)
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
acm/deploy/helm/multicluster-engine/templates/multicluster-engine-operator.deployment.yaml:137
- The backplane operator image digest is duplicated in two places (env var and container
image). This makes future bumps error-prone (easy to update one and miss the other). Recommendation: define this image reference once (e.g., invalues.yamlunder a single key or a named template helper) and reference it from both locations.
value: '{{ .Values.imageRegistry }}/{{ .Values.imageRootRepository }}/backplane-rhel9-operator@sha256:1c59e0a1ed54e8480bbe7e84c271e55cc600391530791412e7eeee9d6444abfa'
acm/deploy/helm/multicluster-engine/templates/multicluster-engine-operator.deployment.yaml:142
- The backplane operator image digest is duplicated in two places (env var and container
image). This makes future bumps error-prone (easy to update one and miss the other). Recommendation: define this image reference once (e.g., invalues.yamlunder a single key or a named template helper) and reference it from both locations.
image: '{{ .Values.imageRegistry }}/{{ .Values.imageRootRepository }}/backplane-rhel9-operator@sha256:1c59e0a1ed54e8480bbe7e84c271e55cc600391530791412e7eeee9d6444abfa'
003e0b3 to
4245da1
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.
Suppressed comments (2)
config/config.yaml:612
- The Thanos image metadata is internally inconsistent:
tag: v0.41.0while theshacomment indicatesv0.42.4. If your image reference is constructed using both tag + sha, this can resolve to an unexpected image (or fail validation if you enforce tag/sha pairing). Align these fields by either updating the tag to match the referenced version, or updating the sha/comment to matchv0.41.0.
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
config/config.yaml:743
- The Thanos image metadata is internally inconsistent:
tag: v0.41.0while theshacomment indicatesv0.42.4. If your image reference is constructed using both tag + sha, this can resolve to an unexpected image (or fail validation if you enforce tag/sha pairing). Align these fields by either updating the tag to match the referenced version, or updating the sha/comment to matchv0.41.0.
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
4245da1 to
d664018
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.
Suppressed comments (2)
config/config.yaml:612
- The thanos image fields are inconsistent:
tagisv0.41.0while theshacomment indicatesv0.42.4. If both fields are used to select/build the image, this can result in deploying an unexpected version. Align the tag with the referenced version (or update the sha/comment to match the tag).
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
config/config.yaml:743
- Same inconsistency in the second thanos block:
tag: v0.41.0but sha comment saysv0.42.4. Align these to avoid confusion and potential version skew.
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
| sources: | ||
| - quay.io/redhat-user-workloads/crt-redhat-acm-tenant/mce-operator-bundle-mce-211@sha256:c8b9aa2f3e0d3db6c11974c2ae820dab5cf3c290f7de8b5115e1839e0a8aab1d | ||
| - quay.io/redhat-user-workloads/crt-redhat-acm-tenant/mce-operator-bundle-mce-211@sha256:80c9c12c8f47f5e94f6129487346379e9b3dce7cae710c3eb1e34914577dc374 | ||
| type: application | ||
| version: 2.11.4 |
| sources: | ||
| - quay.io/redhat-user-workloads/crt-redhat-acm-tenant/mce-operator-bundle-mce-211@sha256:c8b9aa2f3e0d3db6c11974c2ae820dab5cf3c290f7de8b5115e1839e0a8aab1d | ||
| - quay.io/redhat-user-workloads/crt-redhat-acm-tenant/mce-operator-bundle-mce-211@sha256:80c9c12c8f47f5e94f6129487346379e9b3dce7cae710c3eb1e34914577dc374 | ||
| type: application | ||
| version: 2.11.4 |
d664018 to
0dfcae7
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.
Suppressed comments (3)
config/config.yaml:615
- The Thanos
tagremainsv0.41.0while theshacomment indicatesv0.42.4. Even if your tooling uses the digest/sha as the source of truth, this mismatch is confusing and can lead to incorrect assumptions during incident response or upgrades. Please align the tag (and/or the comment) with the pinned digest so they describe the same version.
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
config/config.yaml:747
- The Thanos
tagremainsv0.41.0while theshacomment indicatesv0.42.4. Even if your tooling uses the digest/sha as the source of truth, this mismatch is confusing and can lead to incorrect assumptions during incident response or upgrades. Please align the tag (and/or the comment) with the pinned digest so they describe the same version.
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
acm/deploy/helm/multicluster-engine/templates/multicluster-engine-operator.deployment.yaml:175
- This changes scheduling semantics from a preferred placement on infra nodes (via
preferredDuringSchedulingIgnoredDuringExecution) to a hard requirement (vianodeSelector). If any cluster/environment lacks nodes labeledaro-hcp.azure.com/role: infra, the operator will become unschedulable and remain Pending. If the intent is still 'prefer infra but allow fallback', consider restoring preferred nodeAffinity; if the intent is 'infra-only', consider making this behavior configurable via values so other environments can opt out safely.
nodeSelector:
aro-hcp.azure.com/role: infra
| sources: | ||
| - quay.io/redhat-user-workloads/crt-redhat-acm-tenant/mce-operator-bundle-mce-211@sha256:c8b9aa2f3e0d3db6c11974c2ae820dab5cf3c290f7de8b5115e1839e0a8aab1d | ||
| - quay.io/redhat-user-workloads/crt-redhat-acm-tenant/mce-operator-bundle-mce-211@sha256:07a34fcadced16168de23d3a53993fae84c3083c390658760b33f1d5f6c5dded |
| sources: | ||
| - quay.io/redhat-user-workloads/crt-redhat-acm-tenant/mce-operator-bundle-mce-211@sha256:c8b9aa2f3e0d3db6c11974c2ae820dab5cf3c290f7de8b5115e1839e0a8aab1d | ||
| - quay.io/redhat-user-workloads/crt-redhat-acm-tenant/mce-operator-bundle-mce-211@sha256:07a34fcadced16168de23d3a53993fae84c3083c390658760b33f1d5f6c5dded |
|
/test e2e-parallel |
|
/hold Revision 0dfcae7 was retested 3 times: holding |
0dfcae7 to
d590f09
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.
Suppressed comments (2)
config/config.yaml:615
- The
tagandshametadata appear to be out of sync (tag: v0.41.0but theshacomment indicates v0.42.4). If both fields participate in image selection/pinning, this can lead to deploying an unintended version; if only one is used, it still creates a misleading config. Align thetagwith the intendedsha(or update the comment/field so they consistently refer to the same upstream version).
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
config/config.yaml:747
- Same tag/SHA mismatch as the earlier
thanosentry. Please update this block to match the intended version consistently.
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
| nodeSelector: | ||
| aro-hcp.azure.com/role: infra |
c7ff1cf to
533b1fa
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.
Suppressed comments (2)
config/config.yaml:619
- The Thanos
tagvalue (v0.41.0) conflicts with the inline comment indicating the pinnedshacorresponds tov0.42.4. This is likely to cause confusion at best, and at worst could pull an unintended image version depending on howtag+shaare combined/consumed downstream. Align these fields by updating thetag(and any rendered outputs) to match the pinned sha/version, or correct the comment/sha to matchv0.41.0.
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
config/config.yaml:751
- The Thanos
tagvalue (v0.41.0) conflicts with the inline comment indicating the pinnedshacorresponds tov0.42.4. This is likely to cause confusion at best, and at worst could pull an unintended image version depending on howtag+shaare combined/consumed downstream. Align these fields by updating thetag(and any rendered outputs) to match the pinned sha/version, or correct the comment/sha to matchv0.41.0.
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
| nodeSelector: | ||
| aro-hcp.azure.com/role: infra |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: aro-hcp-robot[bot], ashishmax31, raelga The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
533b1fa to
ae78031
Compare
|
New changes are detected. LGTM label has been removed. |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.
Suppressed comments (4)
config/config.yaml:620
- The Thanos
tagis still set tov0.41.0while the pinnedshacomment indicatesv0.42.4. This inconsistency risks deploying an unintended version (depending on howtag/shaare used downstream) and is confusing to operators. Align thetag(and/or the comment) with the intended release, and ensure the pinned value corresponds to that version.
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
config/config.yaml:752
- The Thanos
tagis still set tov0.41.0while the pinnedshacomment indicatesv0.42.4. This inconsistency risks deploying an unintended version (depending on howtag/shaare used downstream) and is confusing to operators. Align thetag(and/or the comment) with the intended release, and ensure the pinned value corresponds to that version.
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
acm/deploy/helm/multicluster-engine/templates/multicluster-engine-operator.deployment.yaml:30
- Switching from a preferred infra
nodeAffinityto a hardnodeSelectorchanges scheduling semantics: the operator will now remain Pending if no nodes are labeledaro-hcp.azure.com/role=infra. If this is intentional (must-run-on-infra), consider making the selector configurable via values (so non-infra clusters can deploy), or restoring a preferred affinity-based approach for a safer default.
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
acm/deploy/helm/multicluster-engine/templates/multicluster-engine-operator.deployment.yaml:175
- Switching from a preferred infra
nodeAffinityto a hardnodeSelectorchanges scheduling semantics: the operator will now remain Pending if no nodes are labeledaro-hcp.azure.com/role=infra. If this is intentional (must-run-on-infra), consider making the selector configurable via values (so non-infra clusters can deploy), or restoring a preferred affinity-based approach for a safer default.
nodeSelector:
aro-hcp.azure.com/role: infra
ae78031 to
0ce7c4f
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.
Suppressed comments (4)
config/config.yaml:620
- The Thanos image metadata is internally inconsistent:
tag: v0.41.0while the pinnedshacomment indicates v0.42.4. If consumers combine tag+sha (or validate they match), this can lead to pulling/labeling the wrong version. Align the tag with the sha (or adjust the sha/comment) so they refer to the same upstream release.
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
config/config.yaml:752
- Same issue as the earlier Thanos stanza:
tag: v0.41.0conflicts with the v0.42.4 SHA/comment. Please make tag and sha/comment consistent to avoid version skew in downstream tooling.
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
acm/deploy/helm/multicluster-engine/templates/multicluster-engine-operator.deployment.yaml:175
- This changes scheduling semantics from a preference to a hard requirement:
nodeSelectorwill keep the operator Pending if no nodes carryaro-hcp.azure.com/role=infra(or if those nodes are tainted without matching tolerations). If this is intended for all deployments, consider documenting the required node labeling/taints; otherwise, make the nodeSelector configurable via Helm values so environments without dedicated infra nodes can still schedule the operator.
nodeSelector:
aro-hcp.azure.com/role: infra
config/config-dev-ci.yaml:164
- This line changes style from a quoted digest string to an unquoted scalar with an inline comment, while adjacent fields in this stanza remain quoted. For consistency (and to minimize YAML parsing surprises across tooling), keep the digest formatting consistent with the surrounding config (e.g., quote the digest here as well, or standardize the whole block).
digest: sha256:36f2251c61812dded8489affdc5b16f010705da6001bbfa90e10e318922e5a4d # dd702fa31e866201f704288af2b1e5a2d87d8848 (2026-08-04 19:49)
|
/test e2e-parallel |
chore: render digests using materialize
0ce7c4f to
c1040f9
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.
Suppressed comments (1)
acm/deploy/helm/multicluster-engine/templates/multicluster-engine-operator.deployment.yaml:175
- Introducing a hard
nodeSelectorchanges scheduling semantics from a preference (previouspreferredDuringSchedulingIgnoredDuringExecution) to a requirement. This can prevent the operator from scheduling in clusters that don't label any nodes witharo-hcp.azure.com/role=infra(or during transient labeling issues), creating an availability risk. Consider making this configurable via values (defaulting to the prior preferred behavior), or keeping the soft preference unless a strict requirement is necessary.
nodeSelector:
aro-hcp.azure.com/role: infra
| registry: arohcpsvcdev.azurecr.io | ||
| repository: thanos/thanos | ||
| tag: v0.41.0 | ||
| sha: 6249f7aaadd3695df637fb2eb4cb9a9955611eee691c3970892fe9c0dc3f2db6 # v0.42.2 (2026-07-16 20:22) | ||
| sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37) |
| registry: arohcpsvcdev.azurecr.io | ||
| repository: thanos/thanos | ||
| tag: v0.41.0 | ||
| sha: 6249f7aaadd3695df637fb2eb4cb9a9955611eee691c3970892fe9c0dc3f2db6 # v0.42.2 (2026-07-16 20:22) | ||
| sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37) |
|
Force-merge justification (P0 exception) This does not fit the standard force-merge policy: it is not a clean revert. It is requested as a P0 exception, and the request should be escalated and approved on that basis. 1. P0 security fix with a fixed production deadline. 2. E2E has greened for this change. 3. The required e2e-parallel gate is currently unreliable (flaky), so waiting for a green required run through tide is not dependable. Scope / risk. |
This automated PR updates ARO-HCP container image digests to the latest versions from registries.
Schedule: Monday through Friday at 2 AM UTC
Generated by: periodic-ci-Azure-ARO-HCP-main-image-updater-tooling
Generated at: 2026-08-05T06:32:31+0000