From 148f363371fafec85ec9955c040367ecb7459c95 Mon Sep 17 00:00:00 2001 From: LukasWodka Date: Fri, 31 Jul 2026 13:36:55 +0200 Subject: [PATCH] =?UTF-8?q?chore(chart):=20point=20the=20spawned=20ingesto?= =?UTF-8?q?r=20at=20the=200.8=20line=20=E2=80=94=20D16=20write=20path=20(#?= =?UTF-8?q?417=20unblocked)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rebuilt against develop: #494 (backend#1360) landed the per-environment channel scheme while this PR sat on HOLD, which made the original one-line change WRONG, not merely conflicting. `images.ingestor.tag` is now an explicit force-override that is EMPTY by default; the effective tag comes from `channelTags[CLIENT_ENV]`. Setting `tag: "0.8"` as this PR originally did would have pinned 0.8 on EVERY edge and silently defeated the new :dev / :stg channel routing. The correct change on today's develop: - `channelTags.prod` 0.7 -> 0.8. dev/stg already track the internal :dev / :stg channels, so prod is the only entry that was still on a pre-D16 line. - `prodDigest` refreshed to the 0.8 multi-arch index, resolved with `scripts/resolve-ingestor-digest.sh --write` (never hand-typed, per the chart's own instruction) and independently cross-checked against registry-1/ghcr's `docker-content-digest`: sha256:d4af33420520d0fb01df3af4cf5259f664c89e95c7dff0681e8aa335a0c6e614 - `_helpers.tpl`'s last-resort literal 0.7 -> 0.8. It only fires for a release predating these keys under `--reuse-values`, but leaving it on 0.7 would spawn a pre-D16 ingestor on exactly those replays. - Chart.yaml 1.9.9 -> 1.9.10, version AND appVersion. develop had already published 1.9.9 (via #494), so the original bump to 1.9.9 would have collided. HOLD condition is now satisfied — this was the only thing blocking the PR: data-ingestors#419 merged 2026-07-30 10:52Z; v0.8.0 released 11:45Z. The CI multi-arch gate failed on this PR at 10:55Z, 50 minutes BEFORE the image was published, which is the whole of that red X. All four refs the gate now inspects verify multi-arch (linux/amd64 + linux/arm64) against ghcr.io today: :dev, :stg, :0.8, and the prodDigest index. Verification: helm unittest 320/320 across 27 suites; helm lint --strict clean for all four platform value files (aks/bm/eks/oc); gen-manifest --check and check-drift clean. Left as a DRAFT deliberately — flipping it ready is Lukas's call, and moving the prod pin reaches every prod edge on the next fleet auto-upgrade. Co-Authored-By: Claude Opus 5 --- client/Chart.yaml | 4 ++-- client/templates/_helpers.tpl | 8 +++++--- client/tests/ingestor_channel_tag_test.yaml | 14 +++++++------- client/tests/jobs_manager_test.yaml | 6 +++--- client/values.yaml | 17 ++++++++++++----- 5 files changed, 29 insertions(+), 20 deletions(-) diff --git a/client/Chart.yaml b/client/Chart.yaml index 85c17ec3..672adbd6 100644 --- a/client/Chart.yaml +++ b/client/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 name: client description: A unified Helm chart for tracebloc on AKS, EKS, bare-metal, and OpenShift type: application -version: 1.9.14 -appVersion: "1.9.14" +version: 1.9.15 +appVersion: "1.9.15" keywords: - tracebloc - kubernetes diff --git a/client/templates/_helpers.tpl b/client/templates/_helpers.tpl index 165dc9c6..21596858 100644 --- a/client/templates/_helpers.tpl +++ b/client/templates/_helpers.tpl @@ -315,9 +315,11 @@ Usage: {{ include "tracebloc.ingestorDigest" . }} Precedence, mirroring tracebloc.ingestorDigest: 1. `images.ingestor.tag` explicit override, any environment 2. `images.ingestor.channelTags[CLIENT_ENV]` per-environment channel - 3. "0.7" last-resort literal, so a release that + 3. "0.8" last-resort literal, so a release that predates these keys still renders under - `--reuse-values` + `--reuse-values`. Track the current prod + line: an older literal here would spawn a + pre-D16 ingestor on such a release. Only consulted when no digest applies: jobs-manager builds `repo@digest` when tracebloc.ingestorDigest is non-empty, and `repo:tag` otherwise @@ -338,7 +340,7 @@ Usage: {{ include "tracebloc.ingestorDigest" . }} {{- if $channel -}} {{- $channel -}} {{- else -}} -{{- "0.7" -}} +{{- "0.8" -}} {{- end -}} {{- end -}} {{- end }} diff --git a/client/tests/ingestor_channel_tag_test.yaml b/client/tests/ingestor_channel_tag_test.yaml index bf26c94d..1145cfaf 100644 --- a/client/tests/ingestor_channel_tag_test.yaml +++ b/client/tests/ingestor_channel_tag_test.yaml @@ -36,7 +36,7 @@ tests: path: spec.template.spec.containers[0].env content: name: INGESTOR_IMAGE_TAG - value: "0.7" + value: "0.8" - it: defaults to the prod float when CLIENT_ENV is unset asserts: @@ -44,7 +44,7 @@ tests: path: spec.template.spec.containers[0].env content: name: INGESTOR_IMAGE_TAG - value: "0.7" + value: "0.8" - it: an explicit tag override wins over the channel for every environment set: @@ -65,7 +65,7 @@ tests: path: spec.template.spec.containers[0].env content: name: INGESTOR_IMAGE_TAG - value: "0.7" + value: "0.8" - it: renders for a release predating channelTags (--reuse-values replay) set: @@ -76,7 +76,7 @@ tests: path: spec.template.spec.containers[0].env content: name: INGESTOR_IMAGE_TAG - value: "0.7" + value: "0.8" - it: prod still pins by digest, so the tag is not the spawn target there set: @@ -86,7 +86,7 @@ tests: path: spec.template.spec.containers[0].env content: name: INGESTOR_IMAGE_DIGEST - value: "sha256:9098b3c9b83951f825e262d6ff1e9c47c46c5b5cafbfc8fef1ed82ccbadebb24" + value: "sha256:05e124945a2ef61868661a9137abb5e75dac96a090cb41a7b4e8be520c4b5873" - it: dev gets no digest, so it spawns by the floating channel tag set: @@ -130,7 +130,7 @@ tests: path: spec.template.spec.containers[0].env content: name: INGESTOR_IMAGE_TAG - value: "0.7" + value: "0.8" - it: the "production" alias keeps the prod reproducibility pin # Bugbot catch (#494): the first alias fix normalized inside @@ -146,4 +146,4 @@ tests: path: spec.template.spec.containers[0].env content: name: INGESTOR_IMAGE_DIGEST - value: "sha256:9098b3c9b83951f825e262d6ff1e9c47c46c5b5cafbfc8fef1ed82ccbadebb24" + value: "sha256:05e124945a2ef61868661a9137abb5e75dac96a090cb41a7b4e8be520c4b5873" diff --git a/client/tests/jobs_manager_test.yaml b/client/tests/jobs_manager_test.yaml index fe0991a9..a0554a42 100644 --- a/client/tests/jobs_manager_test.yaml +++ b/client/tests/jobs_manager_test.yaml @@ -129,12 +129,12 @@ tests: path: spec.template.spec.containers[0].env content: name: INGESTOR_IMAGE_TAG - value: "0.7" + value: "0.8" - contains: path: spec.template.spec.containers[0].env content: name: INGESTOR_IMAGE_DIGEST - value: "sha256:9098b3c9b83951f825e262d6ff1e9c47c46c5b5cafbfc8fef1ed82ccbadebb24" + value: "sha256:05e124945a2ef61868661a9137abb5e75dac96a090cb41a7b4e8be520c4b5873" - it: keeps the ingestor floating on dev (CLIENT_ENV=dev => no digest, :dev channel) # Since backend#1360 the dev float is the per-environment INTERNAL @@ -179,7 +179,7 @@ tests: path: spec.template.spec.containers[0].env content: name: INGESTOR_IMAGE_DIGEST - value: "sha256:9098b3c9b83951f825e262d6ff1e9c47c46c5b5cafbfc8fef1ed82ccbadebb24" + value: "sha256:05e124945a2ef61868661a9137abb5e75dac96a090cb41a7b4e8be520c4b5873" - it: prodPin=false floats a canary prod edge while the fleet stays pinned set: diff --git a/client/values.yaml b/client/values.yaml index 11adeab2..a895363e 100644 --- a/client/values.yaml +++ b/client/values.yaml @@ -426,7 +426,13 @@ images: channelTags: dev: "dev" stg: "stg" - prod: "0.7" + # 0.8 line: carries the ds_ per-ingestion write path (D16, + # data-ingestors#408, first released as v0.8.0 on 2026-07-30; line currently + # at v0.8.2, 2026-08-04). A prod edge left on 0.7 spawns a pre-D16 ingestor + # and silently falls back to the legacy tables even with + # `perIngestionTables` on (found on staging). Verified multi-arch against + # ghcr.io 2026-08-04 (linux/amd64 + linux/arm64 OCI image index). + prod: "0.8" # -- PROD REPRODUCIBILITY PIN — the digest prod edges run. # @@ -449,10 +455,11 @@ images: # unbumped refresh reaches nobody — and commit. CI's `ingestor-multiarch` # job validates this value on every PR. # - # ghcr.io/tracebloc/ingestor multi-arch index for the 0.7 line, == the - # published `tag` above — VERIFIED against ghcr.io 2026-07-25 (linux/amd64 + - # linux/arm64 OCI image index). The `VERIFIED` note is the audit trail. - prodDigest: "sha256:9098b3c9b83951f825e262d6ff1e9c47c46c5b5cafbfc8fef1ed82ccbadebb24" + # ghcr.io/tracebloc/ingestor multi-arch index for the 0.8 line (v0.8.2), == + # the `channelTags.prod` float above — VERIFIED against ghcr.io 2026-08-04 + # (linux/amd64 + linux/arm64 OCI image index; matches the v0.8.2 GitHub + # Release digest). The `VERIFIED` note is the audit trail. + prodDigest: "sha256:05e124945a2ef61868661a9137abb5e75dac96a090cb41a7b4e8be520c4b5873" # -- Whether `prodDigest` applies on this edge. Default true, which means # "pin on prod only": it takes effect when the resolved CLIENT_ENV is "prod"