konveyor/operator

Enable use of pinned image checksums in releases opposed to floating tags

Closed this issue · 6 comments

jwmatthews commented

We have some users who are running on 'disconnected' or 'airgapped' OpenShift clusters that want to consume Konveyor releases yet are blocked from our use of floating tags opposed to pinned image checksums.

The ask is to update our release process so when we create new upstream Konveyor releases we pin to specific image checksums.

For background info https://www.redhat.com/en/blog/using-red-hat-openshift-operatorhub-restricted-networks

djzager commented

This seems a better fit for this issue as the most meaningful place to put image checksums is in the CSVs we publish to community-operators.

  • 👍2
shawn-hurley commented

I am a big +1 on SHA references because we know exactly what is being used then regarding user environments.

fbladilo commented

@djzager It would also be nice to inject an image label with the commit hash for each component image built , i.e hub :

LABEL  io.openshift.build.commit.id="${CI_TACKLE2_HUB_UPSTREAM_COMMIT}"
  • 👍2
djzager commented

@jmontleon I think your PR #161 fixes this. Is that right?

djzager commented

Closing as completed by #161