[Backport release-1.7] fix(kubernetes): run Proxmox CCM v0.16.1 and pin the Proxmox images by digest

hack/proxmox-csi-driver-pin_test.bats

@@ -0,0 +1,44 @@
+#!/usr/bin/env bats
+# Upstream releases the Proxmox CSI controller and node plugin together, and
+# its chart renders both from one appVersion. Here they run in two places and
+# are pinned in two packages: the controller in the management cluster
+# (packages/apps/kubernetes, an images/.tag file) and the node plugin in the
+# tenant (packages/system/proxmox-csi, a values override on the vendored
+# chart). Both are pinned by digest because tags in that registry have been
+# re-pushed, and the pin is what takes the version out of the chart's hands:
+# `make update` with a new CHART_VERSION brings new templates and a new
+# appVersion while both pins keep naming the old build, and nothing else
+# notices.
+#
+# This asserts the chart's appVersion and both pins name the same release.
+
+load test_helper
+
+REPO_ROOT="$(cd "$(dirname "${BATS_TEST_FILENAME:-$0}")/.." && pwd)"
+
+@test "the Proxmox CSI controller and node plugin pin the vendored chart's release" {
+  chart="$REPO_ROOT/packages/system/proxmox-csi/charts/proxmox-csi-plugin/Chart.yaml"
+  values="$REPO_ROOT/packages/system/proxmox-csi/values.yaml"
+  tagfile="$REPO_ROOT/packages/apps/kubernetes/images/proxmox-csi-controller.tag"
+
+  app_version=$(yq -r '.appVersion' "$chart")
+  node_tag=$(yq -r '."proxmox-csi-plugin".node.plugin.image.tag' "$values")
+  controller_ref=$(tr -d '[:space:]' < "$tagfile")
+
+  [ -n "$app_version" ] && [ "$app_version" != null ] || {
+    echo "no appVersion in $chart" >&2
+    return 1
+  }
+
+  [ "${node_tag%%@*}" = "$app_version" ] || {
+    echo "node plugin tag '$node_tag' is not the chart appVersion $app_version" >&2
+    echo "set proxmox-csi-plugin.node.plugin.image.tag in packages/system/proxmox-csi/values.yaml" >&2
+    return 1
+  }
+
+  [ "${controller_ref%%@*}" = "ghcr.io/sergelogvinov/proxmox-csi-controller:$app_version" ] || {
+    echo "controller ref '$controller_ref' is not proxmox-csi-controller:$app_version" >&2
+    echo "update packages/apps/kubernetes/images/proxmox-csi-controller.tag" >&2
+    return 1
+  }
+}

packages/apps/kubernetes/images/proxmox-cloud-controller-manager.tag

@@ -0,0 +1 @@
+ghcr.io/sergelogvinov/proxmox-cloud-controller-manager:v0.16.1@sha256:474dbfd3be5c2e0866e520bc6ddb60b7accef554ca7401488eee35252cdf8734

packages/apps/kubernetes/images/proxmox-csi-controller.tag

@@ -0,0 +1 @@
+ghcr.io/sergelogvinov/proxmox-csi-controller:v0.20.0@sha256:95ef74cce03e89a1706d9b32888a84bf44e0db439c4fe2a4334ce123728d4c3b

packages/apps/kubernetes/templates/ccm-proxmox/controller.yaml

@@ -101,7 +101,7 @@ spec:
           readOnlyRootFilesystem: true
       containers:
         - name: cloud-controller-manager
-          image: ghcr.io/sergelogvinov/proxmox-cloud-controller-manager:v0.15.0
+          image: "{{ $.Files.Get "images/proxmox-cloud-controller-manager.tag" | trim }}"
           args:
             - --v=4
             - --cloud-provider=proxmox

packages/apps/kubernetes/templates/csi-proxmox/controller.yaml

@@ -112,7 +112,7 @@ spec:
           readOnlyRootFilesystem: true
       containers:
         - name: csi-driver
-          image: ghcr.io/sergelogvinov/proxmox-csi-controller:v0.20.0
+          image: "{{ $.Files.Get "images/proxmox-csi-controller.tag" | trim }}"
           args:
             - "-v=4"
             - "--csi-address=unix:///csi/csi.sock"

packages/system/proxmox-csi/values.yaml

@@ -33,3 +33,14 @@ proxmox-csi-plugin:
   node:
     tolerations:
       - operator: Exists
+    plugin:
+      # The chart's default is its appVersion as a bare tag, and tags in this
+      # registry have been re-pushed. The digest is the pin; the version must
+      # stay the chart's appVersion and the one in the kubernetes chart's
+      # images/proxmox-csi-controller.tag, since node and controller are two
+      # halves of one driver release (hack/proxmox-csi-driver-pin_test.bats).
+      # The repository repeats the chart default so that hack/lib/image-refs.sh,
+      # which does not read under charts/, sees a complete reference here.
+      image:
+        repository: ghcr.io/sergelogvinov/proxmox-csi-node
+        tag: v0.20.0@sha256:e0151137a1c5fa4faea9b4622436b203f1dc246ea37a3a77d09d3855c70aabd1