Skip to content

chore(deps): bump image-updater from 1.2.1 to 1.3.0, argocd from 3.4.2 to 3.5.1 for GitOps 1.22 #1257

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chengfang wants to merge 3 commits into
base: master
Choose a base branch
from
Open

chore(deps): bump image-updater from 1.2.1 to 1.3.0, argocd from 3.4.2 to 3.5.1 for GitOps 1.22 #1257

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
621dd6e
chore(deps): bump image-updater from 1.2.1 to 1.3.0, argocd from 3.4.…
chengfang Aug 13, 2026
0493dc1
propagate manifests from argocd-operator by running hack/propagate.sh
chengfang Aug 13, 2026
7976a74
fix scheme.Builder deprecation error SA1019
chengfang Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .ci-operator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
build_root_image:
name: openshift-gitops-go-toolset
namespace: ci
tag: 1.26.2
tag: 1.26.3
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Build the manager binary
FROM golang:1.26.2 as builder
FROM golang:1.26.3 as builder
Comment thread
coderabbitai[bot] marked this conversation as resolved.

WORKDIR /workspace
# Copy the Go Modules manifests
Expand Down
4 changes: 0 additions & 4 deletions api/v1alpha1/gitopsservice_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,3 @@ type GitopsServiceList struct {
metav1.ListMeta `json:"metadata,omitempty"`
Items []GitopsService `json:"items"`
}

func init() {
SchemeBuilder.Register(&GitopsService{}, &GitopsServiceList{})
}
12 changes: 10 additions & 2 deletions api/v1alpha1/groupversion_info.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,17 +20,25 @@ limitations under the License.
package v1alpha1

import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/runtime/schema"
"sigs.k8s.io/controller-runtime/pkg/scheme"
)

var (
// GroupVersion is group version used to register these objects
GroupVersion = schema.GroupVersion{Group: "pipelines.openshift.io", Version: "v1alpha1"}

// SchemeBuilder is used to add go types to the GroupVersionKind scheme
SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)

// AddToScheme adds the types in this group-version to the given scheme.
AddToScheme = SchemeBuilder.AddToScheme
)

// addKnownTypes adds the types in this group-version to the given scheme.
func addKnownTypes(scheme *runtime.Scheme) error {
scheme.AddKnownTypes(GroupVersion, &GitopsService{}, &GitopsServiceList{})
metav1.AddToGroupVersion(scheme, GroupVersion)
return nil
}
2 changes: 1 addition & 1 deletion api/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

167 changes: 156 additions & 11 deletions bundle/manifests/argocd-image-updater.argoproj.io_imageupdaters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.19.0
controller-gen.kubebuilder.io/version: v0.21.0
creationTimestamp: null
name: imageupdaters.argocd-image-updater.argoproj.io
spec:
Expand Down Expand Up @@ -180,10 +180,47 @@ spec:
Example: "docker.io/library/nginx:1.17.10", "quay.io/prometheus/node-exporter:v1.5.0".
This field is mandatory.
type: string
imagesVerification:
description: |-
ImagesVerification overrides the signature verification policy for this specific image.
When set, it takes precedence over both the spec-level and ApplicationRef-level
ImagesVerification.
properties:
cosignKey:
description: |-
CosignKey references a Kubernetes Secret in the same namespace as the
ImageUpdater CR that holds the PEM-encoded ECDSA public key used to verify
cosign signatures. Providing this field selects cosign key-based verification.
properties:
key:
description: |-
Key is the key within the Secret's data map whose value contains the credential material
(e.g. "cosign.pub" for a PEM-encoded public key).
type: string
secretName:
description: SecretName is the name of the Kubernetes
Secret.
type: string
required:
- key
- secretName
type: object
enabled:
default: true
description: |-
Enabled controls whether signature verification is active at this scope.
Defaults to true when the ImagesVerification block is present.
Set to false to explicitly opt out of verification for this image or group.
type: boolean
type: object
x-kubernetes-validations:
- message: at least one verification method (cosignKey)
is required when verification is enabled
rule: self.enabled == false || has(self.cosignKey)
manifestTargets:
description: |-
ManifestTarget defines how and where to update this image in Kubernetes manifests.
Only one of Helm or Kustomize should be specified within this block.
Exactly one of Helm, Kustomize, or Plugin should be specified within this block.
This whole block is optional if the image update isn't written to a manifest in a structured way.
properties:
helm:
Expand Down Expand Up @@ -229,11 +266,50 @@ spec:
required:
- name
type: object
plugin:
description: |-
Plugin specifies update parameters if the target manifest is managed by a Config Management Plugin.
When the argocd write-back method is configured, updates will be written as environment variables
in the Argo CD Application spec.source.plugin.env list. When the git write-back method is
configured, updates will be written to the .argocd-source-<appName>.yaml file in the git repository.
properties:
name:
description: |-
Name is the environment variable name for the image repository/name part.
Example: "IMAGE_NAME", "REDIS_IMAGE_REPO".
If Spec is set, this field is ignored.
maxLength: 253
minLength: 1
type: string
spec:
description: |-
Spec is the environment variable name where the full image string
(e.g., "image/name:1.0") should be written.
Use this if your plugin expects the entire image reference in a single env var.
If this is set, Name and Tag will be ignored.
maxLength: 253
minLength: 1
type: string
tag:
description: |-
Tag is the environment variable name for the image tag part.
Example: "IMAGE_TAG", "REDIS_IMAGE_VERSION".
If Spec is set, this field is ignored.
maxLength: 253
minLength: 1
type: string
type: object
x-kubernetes-validations:
- message: At least one of spec or name must be specified
in plugin target.
rule: has(self.spec) || has(self.name)
type: object
x-kubernetes-validations:
- message: Exactly one of helm or kustomize must be specified
within manifestTargets if the block is present.
rule: 'has(self.helm) ? !has(self.kustomize) : has(self.kustomize)'
- message: Exactly one of helm, kustomize, or plugin must
be specified within manifestTargets if the block is
present.
rule: '(has(self.helm) ? 1 : 0) + (has(self.kustomize)
? 1 : 0) + (has(self.plugin) ? 1 : 0) == 1'
required:
- alias
- imageName
Expand All @@ -242,6 +318,44 @@ spec:
x-kubernetes-list-map-keys:
- alias
x-kubernetes-list-type: map
imagesVerification:
description: |-
ImagesVerification overrides the global signature verification policy for applications
matched by this ApplicationRef. When set, it takes precedence over the spec-level
ImagesVerification for all images in this group, but can still be overridden
at the individual ImageConfig level.
properties:
cosignKey:
description: |-
CosignKey references a Kubernetes Secret in the same namespace as the
ImageUpdater CR that holds the PEM-encoded ECDSA public key used to verify
cosign signatures. Providing this field selects cosign key-based verification.
properties:
key:
description: |-
Key is the key within the Secret's data map whose value contains the credential material
(e.g. "cosign.pub" for a PEM-encoded public key).
type: string
secretName:
description: SecretName is the name of the Kubernetes
Secret.
type: string
required:
- key
- secretName
type: object
enabled:
default: true
description: |-
Enabled controls whether signature verification is active at this scope.
Defaults to true when the ImagesVerification block is present.
Set to false to explicitly opt out of verification for this image or group.
type: boolean
type: object
x-kubernetes-validations:
- message: at least one verification method (cosignKey) is required
when verification is enabled
rule: self.enabled == false || has(self.cosignKey)
labelSelectors:
description: LabelSelectors indicates the label selectors to
apply for application selection
Expand Down Expand Up @@ -354,14 +468,11 @@ spec:
type: string
type: object
method:
default: argocd
description: |-
Method defines the method for writing back updated image versions.
This acts as the default if not overridden. If not specified, defaults to "argocd".
pattern: ^(argocd|git|git:[a-zA-Z0-9][a-zA-Z0-9-._/:]*)$
type: string
required:
- method
type: object
required:
- namePattern
Expand Down Expand Up @@ -422,6 +533,43 @@ spec:
This acts as the default if not overridden at a more specific level.
type: string
type: object
imagesVerification:
description: |-
ImagesVerification defines the global default image signature verification policy.
When set, every image update is subject to cryptographic verification before being
committed to Git or applied to an Argo CD Application.
Can be overridden at the ApplicationRef or ImageConfig level.
properties:
cosignKey:
description: |-
CosignKey references a Kubernetes Secret in the same namespace as the
ImageUpdater CR that holds the PEM-encoded ECDSA public key used to verify
cosign signatures. Providing this field selects cosign key-based verification.
properties:
key:
description: |-
Key is the key within the Secret's data map whose value contains the credential material
(e.g. "cosign.pub" for a PEM-encoded public key).
type: string
secretName:
description: SecretName is the name of the Kubernetes Secret.
type: string
required:
- key
- secretName
type: object
enabled:
default: true
description: |-
Enabled controls whether signature verification is active at this scope.
Defaults to true when the ImagesVerification block is present.
Set to false to explicitly opt out of verification for this image or group.
type: boolean
type: object
x-kubernetes-validations:
- message: at least one verification method (cosignKey) is required
when verification is enabled
rule: self.enabled == false || has(self.cosignKey)
writeBackConfig:
description: |-
WriteBackConfig provides global default settings for how and where to write back image updates.
Expand Down Expand Up @@ -472,14 +620,11 @@ spec:
type: string
type: object
method:
default: argocd
description: |-
Method defines the method for writing back updated image versions.
This acts as the default if not overridden. If not specified, defaults to "argocd".
pattern: ^(argocd|git|git:[a-zA-Z0-9][a-zA-Z0-9-._/:]*)$
type: string
required:
- method
type: object
required:
- applicationRefs
Expand Down
Loading
Loading