Problem
Kuadrant currently uses tag-based image references in operator bundles. While this works for most scenarios, digest-based references provide better immutability guarantees and align with container security best practices.
Why Digests?
Using digest-based image references is recommended for container security and immutability:
- Required for OpenShift/OKD disconnected environments: OpenShift documentation explicitly states relatedImages should use digests
- Container security best practice: CNCF Cloud Native Security Whitepaper recommends "Immutable image binary and immutable URL of image" for secure distribution
- Prevents tag mutation: Tags are mutable and can point to different images over time; digests are cryptographically immutable
- Downstream RHCL builds already work this way successfully
Expected Outcome
Starting with Kuadrant 1.5.0, all operator releases should:
- Use digest references in bundle relatedImages
- Generate fully digest-based catalogs
- Align upstream with downstream RHCL practices
Benefits:
- ✅ Better support for disconnected environments (OpenShift/OKD)
- ✅ Reproducible builds
- ✅ Alignment with container security best practices
- ✅ Upstream/downstream consistency
- ✅ Immutable image references
Trade-offs:
- Slightly less human-readable bundle manifests (digests instead of tags in relatedImages)
- Commits to maintaining this for releases going forward
Implementation Status
The machinery already exists. PRs are open for all operator components adding USE_IMAGE_DIGESTS flag (off by default):
All PRs follow the same pattern:
- Add
USE_IMAGE_DIGESTS flag (default: false)
- Generate bundles with
--use-image-digests when enabled
- Add post-generation steps to deduplicate relatedImages
Note: The OpenShift-specific features.operators.openshift.io/disconnected annotation is not included in these PRs. This can be revisited separately if needed, but the digest capability is valuable regardless of disconnected clusters.
Tasks
Related Issues
Problem
Kuadrant currently uses tag-based image references in operator bundles. While this works for most scenarios, digest-based references provide better immutability guarantees and align with container security best practices.
Why Digests?
Using digest-based image references is recommended for container security and immutability:
Expected Outcome
Starting with Kuadrant 1.5.0, all operator releases should:
Benefits:
Trade-offs:
Implementation Status
The machinery already exists. PRs are open for all operator components adding
USE_IMAGE_DIGESTSflag (off by default):All PRs follow the same pattern:
USE_IMAGE_DIGESTSflag (default:false)--use-image-digestswhen enabledNote: The OpenShift-specific
features.operators.openshift.io/disconnectedannotation is not included in these PRs. This can be revisited separately if needed, but the digest capability is valuable regardless of disconnected clusters.Tasks
USE_IMAGE_DIGESTS=truewhen building Kuadrant 1.5.0 bundlesRelated Issues