Documentation
¶
Overview ¶
Package images centralises the policy for selecting Docker image references in embedded Kubernetes manifests and dynamically-created workloads.
Design (post digests-in-git removal):
- Embedded templates mark stack-owned images with the PlaceholderTag (`:__OBOL_IMAGE__`). Digests are never committed to git.
- At apply time (CopyInfrastructure / dynamic resource creation), Resolve rewrites each managed image to a short-SHA tag from version.GitCommit.
- For production security, Resolve also binds the multi-arch index digest from the registry (repo:sha@sha256:…), so a retagged short-SHA cannot silently substitute a different image. Digest fetch is best-effort: if the registry is unreachable, the short-SHA tag alone is used (still privileged over :latest).
- Dev mode (OBOL_DEVELOPMENT=true) uses a caller-supplied dev tag (dev-<sha>) with no digest, matching the local k3d import.
This replaces the old continuous repin-PR machinery: the binary's GitCommit and the image tag always match by construction, so a release that ships source after a fix always asks the cluster for images of that same commit.
Index ¶
- Constants
- Variables
- func BuildReplacers(resolve func(repo string) string) []replacer
- func ClearDigestCache()
- func FetchIndexDigest(repo, tag string) (string, error)
- func Resolve(repo string) string
- func ResolveDev(repo, devTag string) string
- func RewriteBytes(data []byte, replacers []replacer) []byte
- func RewriteTree(root string, resolve func(repo string) string) error
- func StampIdentity() string
Constants ¶
const PlaceholderTag = "__OBOL_IMAGE__"
PlaceholderTag is the sentinel tag embedded templates use for stack-owned images. CopyInfrastructure rewrites every occurrence before helmfile apply. Leaving it unreplaced would fail image pulls loudly (fail-closed).
Variables ¶
var Managed = []string{
"ghcr.io/obolnetwork/x402-verifier",
"ghcr.io/obolnetwork/serviceoffer-controller",
"ghcr.io/obolnetwork/x402-buyer",
"ghcr.io/obolnetwork/job-broker",
"ghcr.io/obolnetwork/demo-server",
"ghcr.io/obolnetwork/obol-stack-public-storefront",
}
ManagedRepos that go through Resolve / RewriteTree. Keep in lockstep with internal/stack baseLocalImages and docker-publish-x402.yml.
Functions ¶
func BuildReplacers ¶ added in v0.13.0
BuildReplacers is exported for tests; production uses RewriteTree.
func FetchIndexDigest ¶ added in v0.13.0
FetchIndexDigest returns the multi-arch index digest GHCR serves for repo:tag (e.g. "sha256:deadbeef…"). Matches `docker buildx imagetools inspect --format '{{ .Manifest.Digest }}'`.
func Resolve ¶
Resolve returns the fully-qualified image reference for a managed repo.
images.Resolve("ghcr.io/obolnetwork/demo-server")
// → "ghcr.io/obolnetwork/demo-server:abc1234@sha256:…" (prod, registry up)
// → "ghcr.io/obolnetwork/demo-server:abc1234" (prod, offline)
// → "ghcr.io/obolnetwork/demo-server:latest" (dev / unknown commit)
Prefer ResolveDev under OBOL_DEVELOPMENT so the local import tag matches.
func ResolveDev ¶ added in v0.13.0
ResolveDev returns repo:devTag with no digest — local builds are imported into k3d under that exact tag.
func RewriteBytes ¶ added in v0.13.0
RewriteBytes applies the pre-built replacers to a single YAML blob. Exported for tests.
func RewriteTree ¶ added in v0.13.0
RewriteTree walks a directory of YAML files and rewrites every managed image reference via resolve. resolve receives the bare repository (e.g. "ghcr.io/obolnetwork/x402-verifier") and returns the full ref.
func StampIdentity ¶ added in v0.13.0
func StampIdentity() string
StampIdentity is included in the defaults-tree stamp so upgrading the binary (new GitCommit) or flipping dev mode re-renders image pins even when embedded template bytes are unchanged.
Types ¶
This section is empty.
Source Files