From f09fc011cee8c780212a87b7e54fb1de7cdd4be5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Tue, 14 Jul 2026 11:17:31 +0200 Subject: [PATCH] versions: deduplicate coco-trustee container image pins MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Store trustee image repositories once under images.* and derive tags from version, updating the KBS deployment test to match. Signed-off-by: Fabiano Fidêncio --- .../kubernetes/confidential_kbs.sh | 21 +++++++++---------- versions.yaml | 14 +++++-------- 2 files changed, 15 insertions(+), 20 deletions(-) diff --git a/tests/integration/kubernetes/confidential_kbs.sh b/tests/integration/kubernetes/confidential_kbs.sh index 8503575312..b3233a95d6 100644 --- a/tests/integration/kubernetes/confidential_kbs.sh +++ b/tests/integration/kubernetes/confidential_kbs.sh @@ -407,9 +407,9 @@ function kbs_k8s_deploy() { # Read from versions.yaml repo=$(get_from_kata_deps ".externals.coco-trustee.url") version=$(get_from_kata_deps ".externals.coco-trustee.version") - image_kbs=$(get_from_kata_deps ".externals.coco-trustee.image_kbs") - image_as=$(get_from_kata_deps ".externals.coco-trustee.image_as") - image_rvps=$(get_from_kata_deps ".externals.coco-trustee.image_rvps") + image_kbs=$(get_from_kata_deps ".externals.coco-trustee.images.kbs") + image_as=$(get_from_kata_deps ".externals.coco-trustee.images.as") + image_rvps=$(get_from_kata_deps ".externals.coco-trustee.images.rvps") # The ingress handler for AKS relies on the cluster's name which in turn # contain the HEAD commit of the kata-containers repository (supposedly the @@ -432,14 +432,13 @@ function kbs_k8s_deploy() { popd echo "::endgroup::" - # Split image references into repository and tag. - # Format is "repo:tag" (e.g. "ghcr.io/confidential-containers/staged-images/kbs-grpc-as:") - local kbs_repo="${image_kbs%:*}" - local kbs_tag="${image_kbs##*:}" - local as_repo="${image_as%:*}" - local as_tag="${image_as##*:}" - local rvps_repo="${image_rvps%:*}" - local rvps_tag="${image_rvps##*:}" + # Image tags match the trustee source version. + local kbs_repo="${image_kbs}" + local kbs_tag="${version}" + local as_repo="${image_as}" + local as_tag="${version}" + local rvps_repo="${image_rvps}" + local rvps_tag="${version}" # Build Helm --set arguments for verifier configuration. # These supplement the values file and avoid embedding YAML inside the heredoc. diff --git a/versions.yaml b/versions.yaml index 98921cf3cc..30daf77d39 100644 --- a/versions.yaml +++ b/versions.yaml @@ -294,16 +294,12 @@ externals: description: "Provides attestation and secret delivery components" url: "https://github.com/confidential-containers/trustee" version: "258ea4acb7b9bd865fce5c63a539f2120dba8298" - # image and image_tag must be in sync - image: "ghcr.io/confidential-containers/staged-images/kbs" - image_tag: "258ea4acb7b9bd865fce5c63a539f2120dba8298" toolchain: "1.90.0" - # Helm chart deploys three separate images (kbs, as, rvps) - # yamllint disable rule:line-length - image_kbs: "ghcr.io/confidential-containers/staged-images/kbs-grpc-as:258ea4acb7b9bd865fce5c63a539f2120dba8298" - image_as: "ghcr.io/confidential-containers/staged-images/coco-as-grpc:258ea4acb7b9bd865fce5c63a539f2120dba8298" - image_rvps: "ghcr.io/confidential-containers/staged-images/rvps:258ea4acb7b9bd865fce5c63a539f2120dba8298" - # yamllint enable rule:line-length + # Helm chart deploys three separate images; tags match version. + images: + kbs: "ghcr.io/confidential-containers/staged-images/kbs-grpc-as" + as: "ghcr.io/confidential-containers/staged-images/coco-as-grpc" + rvps: "ghcr.io/confidential-containers/staged-images/rvps" containerd: description: |