Add tag-based image resolution to the controller (milestone 5a) by alicefr · Pull Request #75 · bootc-dev/bootc-operator

alicefr · 2026-06-24T15:00:43Z

Pools can now reference node images by tag (e.g. registry.example.com/node:latest) instead of requiring a pinned digest. The controller periodically resolves tags to digests using go-containerregistry and updates the pool status with the resolved digest.

The resolution interval is configurable via --tag-resolution-interval (default 5m). Resolution failures are surfaced as a PoolRegistryError degraded condition. An --allow-insecure-registry flag enables fallback to HTTP for registries that do not serve TLS.

alicefr · 2026-06-24T15:06:47Z

@jlebon I opened this draft PR to discuss with you a couple of design points, and I'd love to hear you opinion.

First, how to we expose the time when the tag resolution will take place. In this version, the users see when the next resolution will take place in the bootc pool status in the field nextTagResolutionTime (commit: fd9c1a2).

Secondly, the polling time interval is configurable on the operator side by a flag. IMO, this is something the cluster admin needs to configure. But an alternative could be that it is the user who decides. In this case, we could expose the polling time under the pool spec.

Additionally, I added the supported for untrusted registry if the cluster admin configures the operator with --allow-insecure-registry. First, the controller tries with https, if it fails and the untrusted registries are enabled, then it tries with http.

Please, let me know what you think

alicefr · 2026-06-24T15:10:48Z

We also need to move away from alicefr/bink repository and include the fix bootc-dev/bink#71

jlebon · 2026-06-24T18:27:59Z

We also need to move away from alicefr/bink repository and include the fix bootc-dev/bink#71

➡️ #76

jlebon · 2026-07-01T03:03:13Z

First, how to we expose the time when the tag resolution will take place. In this version, the users see when the next resolution will take place in the bootc pool status in the field nextTagResolutionTime (commit: fd9c1a2).

Seems fine to me.

Secondly, the polling time interval is configurable on the operator side by a flag. IMO, this is something the cluster admin needs to configure. But an alternative could be that it is the user who decides. In this case, we could expose the polling time under the pool spec.

I touched on this a bit in another discussion, but yeah I think there might be a story for a distinction between a cluster admin persona and a "bootc-operator admin" persona. I'm thinking of a managed K8s or HyperShift-like setup, where you may have a user own nodes and schedule their workloads on their nodes but not have full cluster access. But AFAIK actual HyperShift hosted clusters don't actually have edit access to their nodes. The nodes are managed via NodePools, which reside at the management cluster level. And in the case of a managed K8s cluster like EKS, you do actually have full access to the cluster.

So, there might be distinction to draw there in the future, but it's not clear to me yet how prevalent it is in the real world. So I would for now assume that cluster admin = bootc-operator admin. To circle back to the topic at hand though, I think let's leave it as a flag option for now.

Additionally, I added the supported for untrusted registry if the cluster admin configures the operator with --allow-insecure-registry. First, the controller tries with https, if it fails and the untrusted registries are enabled, then it tries with http.

Seems fine to me! (I assume you had to do this for testing?)

Aside but I think at some point, we should also support configuring all operator knobs via a configmap instead. That makes it easier to separate manifest definitions from configs (related to #14). The configmap keys and CLI flags should just match clearly to each other.

jlebon

Partial review

jlebon

Initial pass but looks sane overall!

jlebon · 2026-07-03T02:31:23Z

Some of the later commits could be squashed.

alicefr · 2026-07-03T13:27:15Z

I solved some of the comments I resolved. Squashed some of the latest commits.

But I have added the commit 2eef5ec which introduces the helper functions and resolve in a more elegant way the patching of the option in the controller. Previously, it was completely replacing all the flags for the controller. Now, it replaces existing flags with the flags that the tests needs. In this way, if the there are unrelated flags, they are preserved and tested

jlebon

LGTM overall. Mostly minor nits. Fine to merge as is but I guess you have to rebase anyway for conflicts. :)

Also, let's checkmark the completed milestone steps in the implementation plan.

Nice work!

jlebon · 2026-07-06T14:49:20Z

+)
+
+func TestResolveValidTag(t *testing.T) {
+	tags := []string{"latest", "v1.0"}


Sorry, what I mean here is to test without any tag at all (i.e. implied :latest).

jlebon · 2026-07-06T14:51:27Z

+			srv := httptest.NewServer(registry.New())
+			defer srv.Close()
+
+			// Build a minimal OCI image (empty base + one random layer) to push.
+			layer, err := random.Layer(256, types.OCILayer)
+			g.Expect(err).NotTo(HaveOccurred())
+			img, err := mutate.AppendLayers(empty.Image, layer)
+			g.Expect(err).NotTo(HaveOccurred())
+
+			ref, err := name.ParseReference(fmt.Sprintf("%s/test/image:%s", srv.Listener.Addr().String(), tag))
+			g.Expect(err).NotTo(HaveOccurred())
+			g.Expect(remote.Write(ref, img)).To(Succeed())
+
+			want, err := img.Digest()
+			g.Expect(err).NotTo(HaveOccurred())
+
+			resolver := &GGCRResolver{}
+			got, err := resolver.Resolve(context.Background(), ref.String())
+			g.Expect(err).NotTo(HaveOccurred())
+			g.Expect(got).To(Equal(want.String()))


Does all this have to happen on every iteration? Feels like some of the setup stuff could be lifted out of the loop.

jlebon · 2026-07-06T14:54:41Z

+		return resolveResult, nil
+	}
+
+	if pool.Status.TargetDigest == "" {


The comment you had here before was good (re. first tag resolution failure).

jlebon · 2026-07-06T14:56:31Z

-		return newInvalidSpecError(fmt.Sprintf("image ref %q has no digest (tag resolution not yet supported)", pool.Spec.Image.Ref))
+	if ok {
+		pool.Status.TargetDigest = digested.Digest().String()
+		// Rest the NextTagResolutionTime in case we pass from a tag referenced image to a digested one.


jlebon · 2026-07-06T15:00:34Z

+func TestResolveTargetDigestClearsNextTagResolutionTime(t *testing.T) {
+	g := NewWithT(t)
+
+	pool := testutil.NewPool("tag-to-digest", testImageDigestRefA)
+	next := metav1.NewTime(time.Now().Add(time.Hour))
+	pool.Status.NextTagResolutionTime = &next
+
+	r := &BootcNodePoolReconciler{}
+	_, err := r.resolveTargetDigest(context.Background(), pool)
+	g.Expect(err).NotTo(HaveOccurred())
+	g.Expect(pool.Status.TargetDigest).To(Equal(testDigestA))
+	g.Expect(pool.Status.NextTagResolutionTime).To(BeNil())
+}


Minor: this test is too artificial IMO. I would just drop it, but fine to keep too.

jlebon · 2026-07-06T15:03:00Z

 		return d.DigestStr(), nil
 	}
 	desc, err := remote.Get(parsed, remote.WithContext(ctx))
+	if err != nil && r.AllowInsecure {


Minor: is there a specific typed error we could check for here instead of a blanket retry?

Introduce GGCRResolver to resolve container image tags to digests via remote.Get. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>

Test tag resolution against GGCR's in-memory registry, invalid reference parsing, and unreachable registry errors. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>

New Degraded condition reason for when the controller fails to resolve a tag from the container registry. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>

Tracks when the controller will next resolve a tag-based image ref to a digest. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>

Add TagResolver and TagResolutionInterval to the reconciler struct. The TagResolver defines an interface to solve the image digest. Rewrite resolveTargetDigest to resolve tag refs via the registry with periodic re-resolution, and set Degraded/RegistryError on failure. Wire GGCRResolver and --tag-resolution-interval flag in main.go. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>

Allow falling back to HTTP when resolving tag-based image refs against registries that do not serve TLS. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>

Introduce helper functions for the image handling. The NodeImageTagRef returns the tag-based image reference for the seeded node image, for use in tag resolution e2e tests. The RetagImage takes an image and retags it. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>

The test TestTagResolution verifies that controller is triggering a bootc switch if the image reference by a tag changes in the registry. The test retags the updated image with the same referenced tag. Additionally, the polling time for the controller is reduce the polling time and it configures the insecure registries. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>

TestTagResolution adds ~5m to the suite, pushing past the old 10m limit. Signed-off-by: Alice Frosi <afrosi@redhat.com>

Allow insecure registries and reduce the polling time for the registry resolution tag for the controller. This allows the controller to talk to the bink registry and reduce the polling time to speed up the tests. Signed-off-by: Alice Frosi <afrosi@redhat.com>

Signed-off-by: Alice Frosi <afrosi@redhat.com>

jlebon

🎉

alicefr marked this pull request as draft June 24, 2026 15:00

alicefr force-pushed the milestone-5a branch from 0acf971 to 227abdd Compare June 24, 2026 15:08

alicefr force-pushed the milestone-5a branch 2 times, most recently from b9c79a8 to e3d8661 Compare June 25, 2026 11:22

alicefr commented Jun 25, 2026

View reviewed changes

Comment thread internal/controller/bootcnodepool_controller.go

alicefr marked this pull request as ready for review June 25, 2026 11:35

alicefr marked this pull request as draft June 25, 2026 11:35

alicefr marked this pull request as ready for review June 25, 2026 12:59

alicefr mentioned this pull request Jun 26, 2026

Add getting started and contributing guide #81

Open

jlebon reviewed Jul 1, 2026

View reviewed changes

Comment thread internal/registry/resolver.go

Comment thread internal/registry/resolver_test.go Outdated

Comment thread api/v1alpha1/bootcnodepool_types.go Outdated

jlebon reviewed Jul 3, 2026

View reviewed changes

alicefr force-pushed the milestone-5a branch 2 times, most recently from aa943dd to fbb600c Compare July 3, 2026 12:42

alicefr force-pushed the milestone-5a branch 3 times, most recently from 48e3c51 to 9294316 Compare July 3, 2026 14:33

jlebon reviewed Jul 3, 2026

View reviewed changes

Comment thread internal/controller/bootcnodepool_controller.go

Comment thread internal/controller/bootcnodepool_controller.go

Comment thread internal/registry/resolver_test.go Outdated

alicefr force-pushed the milestone-5a branch from 9294316 to a70e465 Compare July 6, 2026 08:02

jlebon previously approved these changes Jul 6, 2026

View reviewed changes

alicefr added 5 commits July 7, 2026 10:22

controller: add tag resolver using go-containerregistry

a308e31

Introduce GGCRResolver to resolve container image tags to digests via remote.Get. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>

registry: add unit tests for GGCRResolver

f239f07

Test tag resolution against GGCR's in-memory registry, invalid reference parsing, and unreachable registry errors. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>

api: add PoolTagResolutionError degraded reason

5fb0990

New Degraded condition reason for when the controller fails to resolve a tag from the container registry. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>

api: add NextTagResolutionTime status field

25569e6

Tracks when the controller will next resolve a tag-based image ref to a digest. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>

alicefr added 5 commits July 7, 2026 10:24

controller: add --allow-insecure-registry flag

d3201ff

Allow falling back to HTTP when resolving tag-based image refs against registries that do not serve TLS. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>

e2e: increase test timeout to 20m

2c29257

TestTagResolution adds ~5m to the suite, pushing past the old 10m limit. Signed-off-by: Alice Frosi <afrosi@redhat.com>

alicefr dismissed jlebon’s stale review via 81c25e9 July 7, 2026 08:24

alicefr force-pushed the milestone-5a branch from a70e465 to 81c25e9 Compare July 7, 2026 08:24

Mark milestone-5a as complete

aa89b4c

Signed-off-by: Alice Frosi <afrosi@redhat.com>

jlebon approved these changes Jul 7, 2026

View reviewed changes

jlebon merged commit cb56515 into bootc-dev:main Jul 7, 2026
12 checks passed

Uh oh!

Conversation

alicefr commented Jun 24, 2026

Uh oh!

alicefr commented Jun 24, 2026

Uh oh!

alicefr commented Jun 24, 2026

Uh oh!

jlebon commented Jun 24, 2026

Uh oh!

Uh oh!

jlebon commented Jul 1, 2026

Uh oh!

jlebon left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jlebon left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jlebon commented Jul 3, 2026

Uh oh!

alicefr commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jlebon left a comment

Choose a reason for hiding this comment

Uh oh!

jlebon Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

jlebon Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

jlebon Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

jlebon Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

jlebon Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

jlebon Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

jlebon left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

alicefr commented Jul 3, 2026 •

edited

Loading