chore: update component image digests (excluding hypershift) - #6370
chore: update component image digests (excluding hypershift)#6370Inbharaj Mani (inbharajmani) wants to merge 4 commits into
Conversation
chore: render digests using materialize
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: inbharajmani The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
There was a problem hiding this comment.
Pull request overview
Updates the repository’s pinned component image references (digests/SHAs) while preventing the periodic image-updater flow from advancing the standalone HyperShift operator image that is currently causing E2E failures.
Changes:
- Pin
hypershiftintooling/image-updater/config.yamlto a specific tag (commit SHA) to prevent auto-updates. - Bump multiple component digests/SHAs in
config/config.yamland propagate them into rendered dev environment configs. - Update ACM MCE chart/fixtures to 2.11.5 (including refreshed operand image references and scheduling fields in the operator deployment template).
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tooling/image-updater/config.yaml | Pins HyperShift operator tag to prevent image-updater from auto-advancing it. |
| config/config.yaml | Updates default component digests/SHAs (incl. Thanos, Velero, ACM, clusters-service, etc.). |
| config/rendered/dev/pers/westus3.yaml | Materialized dev config updates for the new digests/SHAs. |
| config/rendered/dev/perf/westus3.yaml | Materialized dev config updates for the new digests/SHAs. |
| config/rendered/dev/dev/westus3.yaml | Materialized dev config updates for the new digests/SHAs. |
| config/rendered/dev/cspr/westus3.yaml | Materialized dev config updates for the new digests/SHAs. |
| config/rendered/dev/ci01/centralus.yaml | Materialized dev config updates for the new digests/SHAs. |
| config/rendered/dev/ci00/centralus.yaml | Materialized dev config updates for the new digests/SHAs. |
| acm/deploy/helm/multicluster-engine/templates/multicluster-engine-operator.deployment.yaml | Updates MCE operator deployment template (operand image refs + scheduling fields). |
| acm/deploy/helm/multicluster-engine/Chart.yaml | Bumps MCE chart version/appVersion to 2.11.5 and updates source digest reference. |
| acm/deploy/helm/multicluster-engine-crds/Chart.yaml | Bumps MCE CRDs chart version/appVersion to 2.11.5 and updates source digest reference. |
| acm/zz_fixture_TestHelmTemplate_dev_westus3_mgmt_1_mce.yaml | Updates Helm fixture output for the MCE bump (including scheduling changes). |
Suppressed comments (1)
config/config.yaml:747
- Same Thanos tag/digest mismatch exists in the MGMT Prometheus Thanos image:
tag: v0.41.0with ashawhose comment indicates v0.42.4. Recommend aligning the tag with the updated image version (and re-materializing) or explicitly documenting the intentional divergence so the deployed image version is unambiguous.
image:
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
| image: | ||
| registry: arohcpsvcdev.azurecr.io | ||
| repository: thanos/thanos | ||
| tag: v0.41.0 | ||
| sha: 6249f7aaadd3695df637fb2eb4cb9a9955611eee691c3970892fe9c0dc3f2db6 # v0.42.2 (2026-07-16 20:22) | ||
| sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37) |
|
/test config-change-detection |
Revert the hypershift image digest to the previous version (3ce5a9b281bb) and pin it in the image-updater config to prevent auto-updates while investigating E2E APIService readiness failures. Ref: AROSLSRE-1685
70b6179 to
68961cc
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.
Suppressed comments (3)
config/config.yaml:747
- Same Thanos tag vs sha mismatch appears in the mgmt Prometheus defaults:
tag: v0.41.0with a sha comment indicatingv0.42.4. If the image is being bumped, update the tag too and re-materialize rendered configs so the generated Helm values use a consistent tag/digest pair.
image:
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
tooling/image-updater/config.yaml:21
- The Hypershift updater entry is disabled, but this comment references a truncated digest and doesn’t mention the commit hash that is actually pinned in config/config.yaml. Consider updating the comment to include the full pinned digest and/or commit so future updates don’t accidentally unpin the wrong image.
# Hypershift image - commented out per AROSLSRE-1685: pinned to sha256:0a0397b7e1fe in config.yaml
config/config.yaml:615
- The Thanos image tag is still
v0.41.0while the pinned sha comment indicatesv0.42.4. Since this tag is consumed in observability/prometheus/values-svc.yaml to build the image reference, the resulting:tag@sha256:digestwill have a mismatched tag/digest pair. If the intent is to bump to v0.42.4, update the tag as well and re-materialize rendered configs.
This issue also appears on line 743 of the same file.
registry: arohcpsvcdev.azurecr.io
repository: thanos/thanos
tag: v0.41.0
sha: b567818fe608067eb0f1d7c2c4fe361e7ad83c8a256234c97685f1d0bf670cc8 # v0.42.4 (2026-07-30 13:37)
| name: cert | ||
| readOnly: true | ||
| nodeSelector: | ||
| aro-hcp.azure.com/role: infra | ||
| securityContext: |
|
Inbharaj Mani (@inbharajmani): The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/close Issue is identified in clusters-service #6371 |
|
Inbharaj Mani (@inbharajmani): Closed this PR. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Summary
3ce5a9b281bbf76f2b68dc2b850c525b322ab316in image-updater config to prevent auto-updatesv1.route.openshift.ionot registered when cluster reports ready)Context
PR #6337 consistently fails 2 E2E tests (
control_plane_automated_z_stream_upgradeandcluster_version_backlevelfor OCP 4.19) due to a timing gap between HyperShift markingHostedClusterAvailable=Trueand the HCCO registering aggregated APIServices in the guest cluster.See companion PR (excluding clusters-service instead) for the alternative split.
Ref: AROSLSRE-1685