feat: image digest (#516)

Author: mikhail-klimko

charts/cf-runtime/.ci/image-digests.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+set -eux
+MYDIR=$(dirname $0)
+REPO_ROOT="${MYDIR}/../../.."
+
+echo "Update image digests"
+docker run \
+    -v "$REPO_ROOT:/venona" \
+    -u $(id -u) \
+    --rm \
+    quay.io/codefresh/codefresh-shell:0.0.20 \
+    /bin/bash /venona/scripts/update_values_with_digests.sh

charts/cf-runtime/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 description: A Helm chart for Codefresh Runner
 name: cf-runtime
-version: 6.4.8
+version: 6.4.9
 keywords:
   - codefresh
   - runner
@@ -18,8 +18,8 @@ annotations:
   # Supported kinds: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`:
   artifacthub.io/changes: |
     - kind: added
-      description: "updating cf-git-cloner image, adding SKIP_TAGS_ON_UPDATE env var to skip tags on update"
+      description: "Added digests for images"
 dependencies:
   - name: cf-common
     repository: oci://quay.io/codefresh/charts
-    version: 0.16.0
+    version: 0.21.0

charts/cf-runtime/README.md

@@ -59,8 +59,8 @@ tests:
                 KUBE_DEPLOY: 'somedomain.io/codefresh/cf-deploy-kubernetes:tagoverride'
                 PIPELINE_DEBUGGER_IMAGE: 'somedomain.io/codefresh/cf-debugger:tagoverride'
                 TEMPLATE_ENGINE: 'somedomain.io/codefresh/pikolo:tagoverride'
-                CR_6177_FIXER: 'somedomain.io/codefresh/alpine:edge'
-                GC_BUILDER_IMAGE: 'somedomain.io/codefresh/cf-gc-builder:0.5.3'
+                CR_6177_FIXER: 'somedomain.io/alpine:tagoverride'
+                GC_BUILDER_IMAGE: 'somedomain.io/codefresh/cf-gc-builder:tagoverride'
                 COSIGN_IMAGE_SIGNER_IMAGE: 'somedomain.io/codefresh/cf-cosign-image-signer:tagoverride'
               workflowLimits:
                 MAXIMUM_ALLOWED_TIME_BEFORE_PRE_STEPS_SUCCESS: 600

charts/cf-runtime/tests/private-registry/private_registry_test.yaml

@@ -69,8 +69,8 @@ tests:
                 KUBE_DEPLOY: 'quay.io/codefresh/cf-deploy-kubernetes:tagoverride'
                 PIPELINE_DEBUGGER_IMAGE: 'quay.io/codefresh/cf-debugger:tagoverride'
                 TEMPLATE_ENGINE: 'quay.io/codefresh/pikolo:tagoverride'
-                CR_6177_FIXER: 'quay.io/codefresh/alpine:edge'
-                GC_BUILDER_IMAGE: 'quay.io/codefresh/cf-gc-builder:0.5.3'
+                CR_6177_FIXER: 'alpine:tagoverride'
+                GC_BUILDER_IMAGE: 'quay.io/codefresh/cf-gc-builder:tagoverride'
                 COSIGN_IMAGE_SIGNER_IMAGE: 'quay.io/codefresh/cf-cosign-image-signer:tagoverride'
               workflowLimits:
                 MAXIMUM_ALLOWED_TIME_BEFORE_PRE_STEPS_SUCCESS: 600

charts/cf-runtime/tests/runtime/runtime_onprem_test.yaml

@@ -16,6 +16,7 @@ runtime:
   dind:
     image:
       tag: tagoverride
+      digest: ""
     resources:
       requests: null
       limits:
@@ -65,6 +66,7 @@ runtime:
   engine:
     image:
       tag: tagoverride
+      digest: ""
     command:
       - one
       - two
@@ -88,6 +90,8 @@ runtime:
       KUBE_DEPLOY: quay.io/codefresh/cf-deploy-kubernetes:tagoverride
       PIPELINE_DEBUGGER_IMAGE: quay.io/codefresh/cf-debugger:tagoverride
       TEMPLATE_ENGINE: quay.io/codefresh/pikolo:tagoverride
+      CR_6177_FIXER: alpine:tagoverride
+      GC_BUILDER_IMAGE: quay.io/codefresh/cf-gc-builder:tagoverride      
       COSIGN_IMAGE_SIGNER_IMAGE: quay.io/codefresh/cf-cosign-image-signer:tagoverride
     env:
       FOO: BAR

charts/cf-runtime/tests/runtime/runtime_onprem_values.yaml

@@ -70,8 +70,8 @@ tests:
                 KUBE_DEPLOY: 'quay.io/codefresh/cf-deploy-kubernetes:tagoverride'
                 PIPELINE_DEBUGGER_IMAGE: 'quay.io/codefresh/cf-debugger:tagoverride'
                 TEMPLATE_ENGINE: 'quay.io/codefresh/pikolo:tagoverride'
-                CR_6177_FIXER: 'quay.io/codefresh/alpine:edge'
-                GC_BUILDER_IMAGE: 'quay.io/codefresh/cf-gc-builder:0.5.3'
+                CR_6177_FIXER: 'alpine:tagoverride'
+                GC_BUILDER_IMAGE: 'quay.io/codefresh/cf-gc-builder:tagoverride'
                 COSIGN_IMAGE_SIGNER_IMAGE: 'quay.io/codefresh/cf-cosign-image-signer:tagoverride'
               userEnvVars:
                 - name: ALICE

charts/cf-runtime/tests/runtime/runtime_test.yaml

@@ -3,6 +3,7 @@ runtime:
     image:
       tag: tagoverride
       pullPolicy: Always
+      digest: ""
     resources:
       requests: null
       limits:
@@ -55,6 +56,7 @@ runtime:
     image:
       tag: tagoverride
       pullPolicy: Always
+      digest: ""
     command:
       - one
       - two
@@ -78,6 +80,8 @@ runtime:
       KUBE_DEPLOY: quay.io/codefresh/cf-deploy-kubernetes:tagoverride
       PIPELINE_DEBUGGER_IMAGE: quay.io/codefresh/cf-debugger:tagoverride
       TEMPLATE_ENGINE: quay.io/codefresh/pikolo:tagoverride
+      CR_6177_FIXER: alpine:tagoverride
+      GC_BUILDER_IMAGE: quay.io/codefresh/cf-gc-builder:tagoverride    
       COSIGN_IMAGE_SIGNER_IMAGE: quay.io/codefresh/cf-cosign-image-signer:tagoverride
     env:
       FOO: BAR

charts/cf-runtime/tests/runtime/runtime_values.yaml

@@ -6,6 +6,7 @@ runtime:
   engine:
     image:
       tag: tagoverride
+      digest: ""
     runtimeImages:
       COMPOSE_IMAGE: quay.io/codefresh/compose:tagoverride
       CONTAINER_LOGGER_IMAGE: quay.io/codefresh/cf-container-logger:tagoverride
@@ -18,8 +19,11 @@ runtime:
       KUBE_DEPLOY: quay.io/codefresh/cf-deploy-kubernetes:tagoverride
       PIPELINE_DEBUGGER_IMAGE: quay.io/codefresh/cf-debugger:tagoverride
       TEMPLATE_ENGINE: quay.io/codefresh/pikolo:tagoverride
+      CR_6177_FIXER: alpine:tagoverride
+      GC_BUILDER_IMAGE: quay.io/codefresh/cf-gc-builder:tagoverride
       COSIGN_IMAGE_SIGNER_IMAGE: quay.io/codefresh/cf-cosign-image-signer:tagoverride
 
   dind:
     image:
       tag: tagoverride
+      digest: ""