backups: redisBackupClientImage is committed as a bare tag, against the tag+digest rule #4264

Activity

1. IvanHunters

   added

   kind/bugCategorizes issue or PR as related to a bugCategorizes issue or PR as related to a bug

   triage/needs-triageIndicates an issue needs triage by a maintainerIndicates an issue needs triage by a maintainer

   area/storageIssues or PRs related to storage (linstor, seaweedfs, bucket, velero, harbor)Issues or PRs related to storage (linstor, seaweedfs, bucket, velero, harbor)

   on Sep 15, 2026
2. IvanHunters commented on Sep 15, 2026

   

   IvanHunters

   on Sep 15, 2026

   CollaboratorAuthor

   More actions

   Two things this issue understates.

   The tag does not exist. redis-backup publishes nightly tags and nothing else, so the committed reference does not merely lack a digest, it resolves to nothing:

   $ curl -s .../v2/cozystack/cozystack/redis-backup/tags/list
   {"name":"cozystack/cozystack/redis-backup","tags":[
     "0.0.0-nightly.20260911.34554132544.1","nightly",
     "0.0.0-nightly.20260912.34667295001.1",
     "0.0.0-nightly.20260913.34732721769.1",
     "0.0.0-nightly.20260914.34798944219.1"]}
   
   $ curl -sI .../redis-backup/manifests/v1.6.0   # not found
   $ curl -sI .../cozystack-api/manifests/v1.6.0  # control: answers with a digest
   docker-content-digest: sha256:c4d374a9bc5e6f6e66d24b29396f1eae9d7f06fd268ff767d05c45ca35e84e2e
   

   The control matters: the method finds a released first-party tag when there is one, so the empty answer for redis-backup is a fact about the registry rather than about the query.

   This changes what the fix is. Writing a digest beside the tag is not possible while nothing is published under it; the image needs a release tag first, and only then can the reference be pinned. Until that happens, any lane falling back to the committed reference cannot pull it at all.

   A second reference has the same shape, one step worse. packages/system/migration-controller/values.yaml:2:

   migrationController:
     image: "ghcr.io/cozystack/cozystack/migration-controller:latest"

   A floating tag is not merely unreproducible: it is a reference whose bytes change under a cluster that never asked for a new version. Anonymous pull of that repository is refused (HTTP 403 on the token endpoint) while cozystack-api is public, so it is either private or absent, and the committed fallback is unusable for the same reason as the one above.

   Both keys DO have a producer, which is worth stating because the sibling comment in packages/core/platform/Makefile describes a key that had none and froze at v1.4.0-rc.2. redisBackupClientImage is stamped by packages/system/backupstrategy-controller/Makefile and migrationController.image by packages/system/migration-controller/Makefile. So the stamp is fine and the committed value is the fallback used by every lane that does not rebuild the package, which is exactly where an unpublished or floating tag does its damage.

   Related: the bare-tag spelling of redisBackupClientImage is also what cost backupstrategy-controller its image overlay in e2e (#4257), because a key ending in Image with no digest read as a config change. That half is fixed in #4261; the pin itself is this issue.
3. IvanHunters

   added a commit that references this issue on Sep 17, 2026

   ci(e2e): surface overlay drift and remove both causes of it (#4261)

   ...

   c983390
4. Aleksei Sviridkin (lexfrei)

   added

   triage/acceptedIndicates an issue is ready to be actively worked onIndicates an issue is ready to be actively worked on

   priority/important-longtermImportant over the long term, but may not be staffed and/or may need multiple releases to completeImportant over the long term, but may not be staffed and/or may need multiple releases to complete

   and removed

   triage/needs-triageIndicates an issue needs triage by a maintainerIndicates an issue needs triage by a maintainer

   on Sep 23, 2026