fix(controller): derive full runtime image from the tag name - #2640
fix(controller): derive full runtime image from the tag name#2640rtemperini wants to merge 2 commits into
Conversation
Digest-pinned IMAGE_TAG values produced an invalid OCI reference when skills agents appended -full after @sha256. Parse tag vs digest, suffix only the tag, and pin the full variant only with a dedicated digest. Signed-off-by: Ricardo Temperini <29879569+rtemperini@users.noreply.github.com>
| // Never reuse the slim digest on the full image. | ||
| var fullDigest string | ||
| if embeddedDigest != "" { | ||
| fullDigest = normalizeImageDigest(digest) |
There was a problem hiding this comment.
Can we align the fallback with what the behavior is here? Controller builds always populate the full image digests with the ldflags script, so digest will be non-empty even when the Helm fullDigest is unset.
For IMAGE_TAG=tag@digest, this emits tag-full@<baked upstream digest>; the tag-only fallback described above and in the PR body is reachable only in builds without those linker flags.
So this needs a way to distinguish between an explicit runtime override and a baked-in digtest.
There was a problem hiding this comment.
Sure, declarative skills agents now pin the full variant only when fullDigest (APP_FULL_IMAGE_DIGEST) is set at runtime. The baked digest still applies to sandbox agents. IMAGE_TAG=tag@digest with no runtime override is now app:tag-full, never the slim digest and never the baked upstream digest.
There was a problem hiding this comment.
let me know if this covers this case for baked digest without runtime override
Released builds always bake APP full digests via ldflags. Treat that value as sandbox fallback only. Declarative skills agents pin the full variant only when Helm fullDigest or the matching flag/env is set. Signed-off-by: Ricardo Temperini <29879569+rtemperini@users.noreply.github.com>
github-actions
Bot
added
bug
2 participants
Fixes #2586.
Declarative skills agents built the full runtime image by appending
-fulltoIMAGE_TAG. A digest-pinned tag such as0.10.0-rc3@sha256:…became…@sha256:…-full, which is not a valid OCI reference. The slim and full tags are also different images, so reusing the slim digest would be wrong even if the syntax were valid.What changed
The controller parses
IMAGE_TAGas a tag, atag@digest, or a digest-only value. The-fullsuffix is applied only to the tag name (0.10.0-rc3becomes0.10.0-rc3-full). The slim digest is never reused on the full image.Released builds always bake an upstream full digest (ldflags). That value is sandbox fallback only. Declarative skills agents pin the full variant only when the operator sets
controller.agentImage.fullDigestat runtime.What operators should set
0.10.0-rc3): the full image isapp:0.10.0-rc3-full. Nothing extra to set.0.10.0-rc3@sha256:…): the full image isapp:0.10.0-rc3-full. To digest-pin that variant, setcontroller.agentImage.fullDigest(APP_FULL_IMAGE_DIGEST). The baked upstream digest is not used here.IMAGE_TAG: fail closed unless that runtime full digest is set.Same knobs exist for the Go runtime (
controller.goAgentImage.fullDigest,GOLANG_ADK_FULL_IMAGE_DIGEST).Why this branch
maindeleted the Agent translator (26732e86). The append lives only onrelease/v0.10.x.Tests
go test -raceon./core/internal/controller/translator/agent/, including the0.10.0-rc3@sha256:deadbeef…regression (must not produce…deadbeef…-full) and a baked-digest case that must stayapp:0.10.0-rc3-full.