Repository navigation
flux-plunger, keycloak-operator, kilo and redis-operator have in-repo image builds no CI path ever runs #3416
Description
Activity
- added a commit that references this issue
on Jul 22, 2026 Another source fix just landed in this trap, and the history shows it is not the first.
packages/system/keycloak-operatornow carries a patch that makes the EDP operator stop deleting a user's realm roles whenspec.rolesis unset (upstream report: epam/edp-keycloak-operator#371). The Dockerfile applies everything inpatches/, so the fix is correct in the tree and unreachable in every cluster:hack/build-matrix.shreturns an empty matrix for a change to that directory, and the package is absent from the rootbuild:list, so no workflow rebuilds it.Two earlier commits went the same way without anyone noticing.
9c5fbb69amoved the builder to Go 1.26 and5b9b420ffbumped the base image digests, both editing the Dockerfile and neither updating the pin. The image running today is therefore built from an older Go on older base images than the tree describes, which makes this more than a stale-feature problem: security bumps to these four packages are silently not shipping.Not asking for a decision here, just adding weight. The choice between adding the packages to
build:and dropping the in-repo build is still open, and the split-host mirror gap that option A wakes up is real, so it wants doing deliberately rather than as a side effect of an unrelated patch.- added a commit that references this issue
on Aug 14, 2026 One more for the list:
packages/system/kubeovnstamps a first-party reference into its values (threeyq -isites in its Makefile) and has no entry in the rootbuild:target either, so it sits in the same class as flux-plunger, keycloak-operator and kilo. Found by computing the set mechanically (packages that stamp minus packages the build list iterates) rather than by reading the enumeration in docs/agents/image-refs.md, which names three; that sentence is what drifted, and a hand-maintained list will drift again, so the doc might better point at the computation. redis-operator leaves this list with #2729, which registers its image build.- added and removed
on Sep 23, 2026 This becomes a release blocker with #4505. That PR fails a pre-release when a pinned image is not an amd64+arm64 index, and it builds the arm64 half only for packages in the root
build:list. flux-plunger and keycloak-operator are still outside that list, and their pins are single amd64 manifests, so the first rc after #4505 would fail on them. kilo is outside the list too, but its hand-built pin is already a two-arch index, so it passes for now. redis-operator is in the list since then. I'm preparing a PR that adds the remaining three, and #4505 waits for it.
Summary
The root
Makefilebuild:recipe is the single build list every pipeline iterates:hack/build-matrix.shparses it for the PR/main build matrices, and release-prep (.github/workflows/tags.yaml) runs plainmake build. Four packages ship a Makefileimage:target that builds, pushes and stamps a ref into the tree, but are absent from that list — so no CI path (PR build, main build, release-prep, nightly) ever rebuilds them. Their pins are frozen until someone rebuilds by hand.Evidence
Checked at
91c076137(head of #3404; same onmain). Each package below has animage:target inpackages/system/<pkg>/Makefile; none appears in the rootMakefilebuild:recipe, andgit grepover the Makefile and.github/workflows/finds no other invocation.flux-plungerflux-plunger:latest@sha256:6a6ec9…keycloak-operatorkeycloak-operator:latest@sha256:272792…kilokilo:v1.5.0@sha256:fe837f…redis-operatorredis-operator:v1.3.0-rc1@sha256:a4012e…Consequences
redis-operatorhas carried an rc tag across multiple stable releases, and two images are pinned vialatest@…— both violate the tag-accuracy contract indocs/agents/image-refs.md(fix(ci): cover every image-ref storage shape in promote, retag and mirror #3404): the digest keeps them reproducible, but the tag misrepresents what runs and no:vX.Y.Zconvention lookup can find them.Non-goal
kubeovnis also absent from the build list, but deliberately: its image is built and pushed by cozystack/kubeovn-chart. This issue covers only packages whose build lives in-repo and is never invoked.Options
build:list. They become ordinary build units, repinned at every release-prep. Notekeycloak-operator's stamp writes only.image.tag, leaving the siblingregistry:key untouched — fine for release builds, but it interacts with the nightly split-host rewrite gap documented indocs/agents/image-refs.md.redis-operatoroff the rc pin.Related
docs/agents/image-refs.md).