From 0b019723830036590aa84ddb0ae27d461509bade Mon Sep 17 00:00:00 2001 From: cwiklik Date: Tue, 15 Sep 2026 10:18:02 -0400 Subject: [PATCH 1/2] fix: Pin injected AuthBridge images to cortex v0.7.0-alpha.10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Moves the four injected AuthBridge sidecar images from cortex v0.7.0-alpha.3 to v0.7.0-alpha.10 ahead of the operator v0.4.0-alpha.1 release. All three pin sites move together: * charts/operator/values.yaml (defaults.images.*) — what the chart ships. * operator/internal/webhook/config/defaults.go — the compiled fallbacks that loader.go overlays the platform-config ConfigMap on top of, so a no-ConfigMap deploy still injects a pinned tag. * operator/test/e2e/e2e_suite_test.go (sidecarImages) — the images pulled and loaded into Kind, so e2e exercises what the chart actually ships. release.yml's "injected AuthBridge images must be version-pinned" guard only validates the first two. Leaving the e2e list behind would pass that guard while e2e silently tested the older sidecars, which is the drift its own comment warns against. cortex v0.7.0-alpha.10 is tagged and all four images are published and verified pullable from ghcr.io. Signed-off-by: cwiklik --- charts/operator/values.yaml | 8 ++++---- operator/internal/webhook/config/defaults.go | 8 ++++---- operator/test/e2e/e2e_suite_test.go | 8 ++++---- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/charts/operator/values.yaml b/charts/operator/values.yaml index 53ea0335..49e68909 100644 --- a/charts/operator/values.yaml +++ b/charts/operator/values.yaml @@ -244,10 +244,10 @@ featureGates: # proxy-sidecar / lite mode (always-on enforce-redirect egress capture). defaults: images: - envoyProxy: ghcr.io/rossoctl/cortex/authbridge-envoy:v0.7.0-alpha.3 - authbridge: ghcr.io/rossoctl/cortex/authbridge:v0.7.0-alpha.3 - authbridgeLite: ghcr.io/rossoctl/cortex/authbridge-lite:v0.7.0-alpha.3 - proxyInit: ghcr.io/rossoctl/cortex/proxy-init:v0.7.0-alpha.3 + envoyProxy: ghcr.io/rossoctl/cortex/authbridge-envoy:v0.7.0-alpha.10 + authbridge: ghcr.io/rossoctl/cortex/authbridge:v0.7.0-alpha.10 + authbridgeLite: ghcr.io/rossoctl/cortex/authbridge-lite:v0.7.0-alpha.10 + proxyInit: ghcr.io/rossoctl/cortex/proxy-init:v0.7.0-alpha.10 pullPolicy: IfNotPresent # Proxy settings diff --git a/operator/internal/webhook/config/defaults.go b/operator/internal/webhook/config/defaults.go index 05ced878..835e426b 100644 --- a/operator/internal/webhook/config/defaults.go +++ b/operator/internal/webhook/config/defaults.go @@ -36,18 +36,18 @@ func CompiledDefaults() *PlatformConfig { // :latest on exactly the deploy paths the chart-layer pin doesn't cover. // authbridge-envoy: combined image for envoy-sidecar mode // (Envoy + ext_proc authbridge + spiffe-helper bundled). - EnvoyProxy: "ghcr.io/rossoctl/cortex/authbridge-envoy:v0.7.0-alpha.3", + EnvoyProxy: "ghcr.io/rossoctl/cortex/authbridge-envoy:v0.7.0-alpha.10", // authbridge: combined image for proxy-sidecar mode (default // deployment shape) — authbridge-proxy + spiffe-helper // bundled, no Envoy, no gRPC. - AuthBridge: "ghcr.io/rossoctl/cortex/authbridge:v0.7.0-alpha.3", + AuthBridge: "ghcr.io/rossoctl/cortex/authbridge:v0.7.0-alpha.10", // authbridge-lite: size-optimized variant for the "lite" // mode. Same listener layout as AuthBridge but parsers // (a2a/mcp/inference) are dropped. - AuthBridgeLite: "ghcr.io/rossoctl/cortex/authbridge-lite:v0.7.0-alpha.3", + AuthBridgeLite: "ghcr.io/rossoctl/cortex/authbridge-lite:v0.7.0-alpha.10", // proxy-init: iptables init container, used by // envoy-sidecar mode only. - ProxyInit: "ghcr.io/rossoctl/cortex/proxy-init:v0.7.0-alpha.3", + ProxyInit: "ghcr.io/rossoctl/cortex/proxy-init:v0.7.0-alpha.10", PullPolicy: corev1.PullIfNotPresent, }, Proxy: ProxyConfig{ diff --git a/operator/test/e2e/e2e_suite_test.go b/operator/test/e2e/e2e_suite_test.go index 3d695ca1..1b755aae 100644 --- a/operator/test/e2e/e2e_suite_test.go +++ b/operator/test/e2e/e2e_suite_test.go @@ -66,10 +66,10 @@ var ( // Keep tags in sync with charts/operator/values.yaml (defaults.images.*) so // e2e exercises the images the chart actually ships, not :latest. sidecarImages = []string{ - "ghcr.io/rossoctl/cortex/authbridge-envoy:v0.7.0-alpha.3", - "ghcr.io/rossoctl/cortex/authbridge:v0.7.0-alpha.3", - "ghcr.io/rossoctl/cortex/authbridge-lite:v0.7.0-alpha.3", - "ghcr.io/rossoctl/cortex/proxy-init:v0.7.0-alpha.3", + "ghcr.io/rossoctl/cortex/authbridge-envoy:v0.7.0-alpha.10", + "ghcr.io/rossoctl/cortex/authbridge:v0.7.0-alpha.10", + "ghcr.io/rossoctl/cortex/authbridge-lite:v0.7.0-alpha.10", + "ghcr.io/rossoctl/cortex/proxy-init:v0.7.0-alpha.10", } ) From eeb881a9f39b5c731997b096ad283bea7156b2ec Mon Sep 17 00:00:00 2001 From: cwiklik Date: Tue, 15 Sep 2026 10:57:38 -0400 Subject: [PATCH 2/2] Docs: Realign the e2e README with the four images actually loaded The prose listed authbridge-envoy, proxy-init and spiffe-helper. That predates the combined images: spiffe-helper is no longer pulled on its own (it ships inside authbridge-envoy and authbridge), and authbridge and authbridge-lite were missing from the list entirely. Pre-existing drift, but this is the natural PR to fix it in, since the sidecarImages list it describes is being touched here. Signed-off-by: cwiklik --- operator/test/e2e/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/operator/test/e2e/README.md b/operator/test/e2e/README.md index 40c218b6..60c3b631 100644 --- a/operator/test/e2e/README.md +++ b/operator/test/e2e/README.md @@ -15,7 +15,7 @@ End-to-end tests for the rossoctl-operator. The suite runs 25 specs: - [kubectl](https://kubernetes.io/docs/tasks/tools/) — `brew install kubectl` - Container runtime: **Docker** or **Podman** -The test suite auto-detects Docker vs Podman. No env vars needed. AuthBridge sidecar images (`authbridge-envoy`, `proxy-init`, `spiffe-helper`) are pulled from `ghcr.io/rossoctl/cortex` and loaded into Kind during setup. +The test suite auto-detects Docker vs Podman. No env vars needed. AuthBridge sidecar images (`authbridge-envoy`, `authbridge`, `authbridge-lite`, `proxy-init`) are pulled from `ghcr.io/rossoctl/cortex` and loaded into Kind during setup. `spiffe-helper` is not pulled separately — it is bundled into the combined `authbridge-envoy` and `authbridge` images. ## Run