chore(apps): pin every floating image tag to the version already running #171

Merged

kblack0610 merged 1 commit from feat/pin-floating-image-tags into master

2026-08-11 16:53:52 +00:00

kblack0610 commented

2026-08-11 16:53:16 +00:00

Owner

Prerequisite for Renovate: it cannot bump a tag that encodes no version.

Every tag was resolved from the digest actually running in-cluster, then verified to resolve back to that same digest. This renames what is deployed without changing a byte.

image	was	now
home-assistant	`:stable`	`:2025.11.3` (19 refs)
immich-server	`:release`	`:v3.0.1`
immich-ml	`:release-rocm`	`:v3.0.1-rocm`
litellm	`:main-stable`	`:v1.96.0`
cloudflared	`:latest`	`:2026.7.3`
alpine	`:latest`	`:3.24.1` (13 refs)
busybox	`:latest`	`:1.38`

The floating tags were not keeping anything current. HA was serving 2025.11.3 under :stable, and immich-ml :release-rocm now points at a digest the running pod has never had.

Two refs could not just be pinned:

samba publishes no version tag matching the running digest (:latest is ahead of every a*-s*-r* tag), so it is digest-pinned - same shape apps/vaultwarden already uses.
bitnami/kubectl has zero version tags left. Bitnami emptied its free Docker Hub repos in 2025 and froze them under bitnamilegacy/*. That ref was unpinnable AND unmaintained, and it was carrying the SOPS age-key backup. Moved to alpine/k8s:1.33.5 (what apps/flux-audit already uses, and it has the shell that job needs - registry.k8s.io/kubectl is distroless and would have broken /bin/sh -c).

ghcr.io/openclaw/openclaw:latest left alone: apps/openclaw/kustomization.yaml rewrites it to our own registry, so the upstream ref is never pulled.

Verification

All 8 pinned tags verified to resolve to the exact digest running in-cluster (registry manifest digest comparison).
kubectl kustomize builds clean for every touched app and for apps/ as a whole.
sops-backup job script calls only echo/kubectl/ls/mkdir, all present in alpine/k8s.

Prerequisite for Renovate: it cannot bump a tag that encodes no version. Every tag was resolved from the digest **actually running in-cluster**, then verified to resolve back to that same digest. This renames what is deployed without changing a byte. | image | was | now | |---|---|---| | home-assistant | `:stable` | `:2025.11.3` (19 refs) | | immich-server | `:release` | `:v3.0.1` | | immich-ml | `:release-rocm` | `:v3.0.1-rocm` | | litellm | `:main-stable` | `:v1.96.0` | | cloudflared | `:latest` | `:2026.7.3` | | alpine | `:latest` | `:3.24.1` (13 refs) | | busybox | `:latest` | `:1.38` | The floating tags were not keeping anything current. HA was serving **2025.11.3** under `:stable`, and immich-ml `:release-rocm` now points at a digest the running pod has never had. **Two refs could not just be pinned:** - **samba** publishes no version tag matching the running digest (`:latest` is ahead of every `a*-s*-r*` tag), so it is digest-pinned - same shape `apps/vaultwarden` already uses. - **bitnami/kubectl has zero version tags left.** Bitnami emptied its free Docker Hub repos in 2025 and froze them under `bitnamilegacy/*`. That ref was unpinnable AND unmaintained, and it was carrying the **SOPS age-key backup**. Moved to `alpine/k8s:1.33.5` (what `apps/flux-audit` already uses, and it has the shell that job needs - `registry.k8s.io/kubectl` is distroless and would have broken `/bin/sh -c`). `ghcr.io/openclaw/openclaw:latest` left alone: `apps/openclaw/kustomization.yaml` rewrites it to our own registry, so the upstream ref is never pulled. ## Verification - All 8 pinned tags verified to resolve to the exact digest running in-cluster (registry manifest digest comparison). - `kubectl kustomize` builds clean for every touched app and for `apps/` as a whole. - sops-backup job script calls only `echo`/`kubectl`/`ls`/`mkdir`, all present in `alpine/k8s`.

kblack0610 added 1 commit

2026-08-11 16:53:16 +00:00

chore(apps): pin every floating image tag to the version already running 80764a4a49

Nothing in this cluster auto-updates and nothing scans, so a floating tag
(:latest / :stable / :release / :main-stable) was not keeping anything
current - it was only making the deployed version unknowable. The pods had
in fact drifted months behind the tag they claimed to track: Home Assistant
was serving 2025.11.3 under :stable, and immich-machine-learning's
:release-rocm now points at a digest the running pod has never had.

Every tag here was resolved from the digest actually running in-cluster and
verified to resolve back to that same digest, so this renames what is
deployed without changing a single byte:

  home-assistant  :stable        -> :2025.11.3      (19 refs)
  immich-server   :release       -> :v3.0.1
  immich-ml       :release-rocm  -> :v3.0.1-rocm
  litellm         :main-stable   -> :v1.96.0
  cloudflared     :latest        -> :2026.7.3
  alpine          :latest        -> :3.24.1         (13 refs)
  busybox         :latest        -> :1.38

Two refs could not simply be pinned:

- servercontainers/samba publishes no version tag matching the running
  digest (:latest is ahead of every a*-s*-r* tag), so it is pinned by
  digest instead - the same shape apps/vaultwarden already uses.
- bitnami/kubectl has zero version tags left; Bitnami emptied its free
  Docker Hub repos in 2025 and froze the images under bitnamilegacy/*.
  That ref was unpinnable AND unmaintained, and it was carrying the SOPS
  age-key backup. Moved to alpine/k8s:1.33.5, which apps/flux-audit already
  uses and which has the shell that job's /bin/sh -c needs
  (registry.k8s.io/kubectl is distroless and would have broken it).

ghcr.io/openclaw/openclaw:latest is left alone: apps/openclaw/kustomization
rewrites it to our own registry, so the upstream ref is never pulled.

Prerequisite for Renovate - it cannot bump a tag that encodes no version.