Skip to content

fix: update digest lookup to use versioned RepoTags instead of latest #1935

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
shivakunv wants to merge 1 commit into
base: main
Choose a base branch
from
+61 −51
Open

fix: update digest lookup to use versioned RepoTags instead of latest #1935

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 36 additions & 28 deletions .github/renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,36 +27,40 @@
"recreateWhen": "always",
"separateMultipleMajor": false,
"separateMinorPatch": false,
"pruneStaleBranches": true,
"rebaseWhen": "always",
"force": {
"createPr": true,
"createPrEvenIfClosed": true
},

"customManagers": [
{
"customType": "regex",
"managerFilePatterns": [
"bundle/manifests/gpu-operator-certified.clusterserviceversion.yaml"
"deployments/gpu-operator/values.yaml"
],
"matchStrings": [
"[-\\s]*value:\\s*\"?(?<depName>[^:\"]+)(?::(?<currentValue>[^@\"]+))?@(?<currentDigest>sha256:[a-f0-9]{64})\"?",
"[-\\s]*image: (?<depName>.*?)(?::(?<currentValue>.*?))?@(?<currentDigest>sha256:[a-f0-9]{64})",
"- name: (?<suffix>[\\w-]+)[-\\s]*image: (?<depName>.*?)(?::(?<currentValue>.*?))?@(?<currentDigest>sha256:[a-f0-9]{64})"
"[-\\s]*repository:\\s*(?<repo>\\S+)\\s*\\n(?:\\s*#.*\\n|\\s*\\n)*[-\\s]*image:\\s*(?<image>\\S+)\\s*\\n(?:\\s*#.*\\n|\\s*\\n)*[-\\s]*version:\\s*(?<currentValue>\\S+)"
Copy link
Contributor

@rajathagasthya rajathagasthya Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Regexes are hard to understand. Do you mind giving a quick rundown of what this is doing?

Copy link
Contributor Author

@shivakunv shivakunv Dec 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suppose we have image format as this in values.yaml :-

driverManager:
    repository: nvcr.io/nvidia/cloud-native
    image: k8s-driver-manager
    # When choosing a different version of k8s-driver-manager, DO NOT downgrade to a version lower than v0.6.4
    # to ensure k8s-driver-manager stays compatible with gpu-operator starting from v24.3.0
    version: v0.9.1
    imagePullPolicy: IfNotPresent
    env: []

[-\\s]*repository:\\s*(?<repo>\\S+)\\s*\\n
: [-\\s]* : - (list preseent or not ) or indentation match (optional)
: repository: match repository word
: \\s*(?<repo>\\S+): capture nvcr.io/nvidia/cloud-native
: \s*\n : ends at new line

(?:\\s*#.*\\n|\\s*\\n)*
: to ignore any blank lines, comment (#) or any formatting issue.

[-\\s]*image:\\s*(?<image>\\S+)\\s*\\n :
only change here is capture image: k8s-driver-manager

another
(?:\\s*#.*\\n|\\s*\\n)* :
ignore blank , line comments etc .
these lines will be ignored
# When choosing a different version of k8s-driver-manager, DO NOT downgrade to a version lower than v0.6.4
# to ensure k8s-driver-manager stays compatible with gpu-operator starting from v24.3.0

(?:\\s*#.*\\n|\\s*\\n)*[-\\s]*version:\\s* : captures version
(?\S+)" : use version value v0.9.1` as currentValue and query docker data source for new version due to rule L:46 and L:47:
```
"depNameTemplate": "{{repo}}/{{image}}",
"datasourceTemplate": "docker",

],
"versioningTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
"datasourceTemplate": "docker"
"depNameTemplate": "{{repo}}/{{image}}",
Copy link
Contributor Author

@shivakunv shivakunv Dec 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this depNameTemplate ensures matching updates in file bundle/manifests/gpu-operator-certified.clusterserviceversion.yaml for depName variable

"datasourceTemplate": "docker",
"versioningTemplate": "loose"
},
{
"customType": "regex",
"managerFilePatterns": [
"deployments/gpu-operator/values.yaml"
"bundle/manifests/gpu-operator-certified.clusterserviceversion.yaml"
],
"matchStrings": [
"[-\\s]*repository:\\s*(?<repo>\\S+)\\s*\\n(?:\\s*#.*\\n|\\s*\\n)*[-\\s]*image:\\s*(?<image>\\S+)\\s*\\n(?:\\s*#.*\\n|\\s*\\n)*[-\\s]*version:\\s*(?<currentValue>\\S+)"
"(?:value|image):\\s*[\"']?(?<depName>[^:\"'\\s]+):(?<currentValue>[^@\"'\\s]+)@(?<currentDigest>sha256:[a-f0-9]{64})"
],
"depNameTemplate": "{{repo}}/{{image}}",
"datasourceTemplate": "docker",
"versioningTemplate": "loose"
"datasourceTemplate": "docker"
}
],

"packageRules": [
{
"matchPaths": ["deployments/gpu-operator/values.yaml"],
"matchPackageNames": [
"nvcr.io/nvidia/cloud-native/k8s-driver-manager",
"nvcr.io/nvidia/cloud-native/k8s-kata-manager",
Expand All @@ -69,37 +73,41 @@
"separateMajorMinor": false
},
{
"matchPaths": ["deployments/gpu-operator/values.yaml"],
"matchPackageNames": [
"nvcr.io/nvidia/k8s/container-toolkit",
"nvcr.io/nvidia/cloud-native/k8s-mig-manager"
"nvcr.io/nvidia/cloud-native/k8s-mig-manager"
],
"versioning": "regex:^v?(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-ubuntu(?<ubuntu>\\d+\\.\\d+)$",
"versioning": "regex:^v?(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
"separateMajorMinor": false
},
{
"matchPaths": ["deployments/gpu-operator/values.yaml"],
"matchPackageNames": [
"nvcr.io/nvidia/k8s/dcgm-exporter"
],
"versioning": "regex:^v?(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-distroless$",
"matchPackageNames": ["nvcr.io/nvidia/cuda"],
"versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-base-ubi9$",
"separateMajorMinor": false
},
{
"matchPaths": ["deployments/gpu-operator/values.yaml"],
"matchPackageNames": [
"nvcr.io/nvidia/cuda"
],
"versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-base-ubi9$",
"matchPackageNames": ["nvcr.io/nvidia/k8s/dcgm-exporter"],
"versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-\\d+\\.\\d+\\.\\d+-distroless$",
"separateMajorMinor": false
},
{
"matchPackageNames": ["nvcr.io/nvidia/cloud-native/dcgm"],
"versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-(?<rev>\\d+)-ubi9$",
"separateMajorMinor": false
},
{
"matchPackageNames": ["nvcr.io/nvidia/k8s/container-toolkit"],
"versioning": "regex:^v?(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)(?:-rc\\.(?<build>\\d+))?$",
"separateMajorMinor": false
},
{
"matchPackageNames": ["nvcr.io/nvidia/driver"],
"enabled": false
},
{
"matchDatasources": ["*"],
"groupName": "{{depName}}"
"matchDatasources": ["docker"],
"groupName": "{{depName}}",
"branchTopic": "{{depName}}",
"commitMessageTopic": "{{depName}}"
}
]
}
46 changes: 24 additions & 22 deletions bundle/manifests/gpu-operator-certified.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,38 +201,39 @@ spec:
- name: gpu-operator-image
image: ghcr.io/nvidia/gpu-operator:main-latest
- name: dcgm-exporter-image
image: nvcr.io/nvidia/k8s/dcgm-exporter@sha256:7c0ac4430bb0a5868b7404a0e06c47e02b0375b61aadd614385ad0bc2d43815a
image: nvcr.io/nvidia/k8s/dcgm-exporter:4.4.2-4.7.0-distroless@sha256:7c0ac4430bb0a5868b7404a0e06c47e02b0375b61aadd614385ad0bc2d43815a
Copy link
Contributor

@rajathagasthya rajathagasthya Dec 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@shivakunv Let's separate changes to this file which introduces a new tagging convention into a different PR. The reason is we may need to check with RedHat to make sure this doesn't break their certification.

Once that change is done, we can run your renovate changes to see if things are updating correctly.

Copy link
Contributor Author

@shivakunv shivakunv Dec 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes to this file will not be separated, because the purpose of Renovate ( here ) is to update both values.yaml and the bundle/manifests/gpu-operator-certified.clusterserviceversion.yaml file simultaneously.

Currently, the Renovate bot is broken for the bundle/manifests/gpu-operator-certified.clusterserviceversion.yaml file, as it sometimes opens the wrong PR. The Renovate PR for values.yaml is working fine.
Both PRs (opened by renovate) should open together and be merged into main.

Until this change is merged into main, we need to manually review and update the PR created by Renovate bot for thebundle/manifests/gpu-operator-certified.clusterserviceversion.yaml . @rajathagasthya

Copy link
Contributor Author

@shivakunv shivakunv Dec 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @rajathagasthya for your review
@cdesiniotis PTAL

- name: dcgm-image
image: nvcr.io/nvidia/cloud-native/dcgm@sha256:99187d6b023689f50cf065c77b96ba5aacfa26a618854608a1e31da5e826b765
image: nvcr.io/nvidia/cloud-native/dcgm:4.4.2-1-ubi9@sha256:99187d6b023689f50cf065c77b96ba5aacfa26a618854608a1e31da5e826b765
- name: container-toolkit-image
image: nvcr.io/nvidia/k8s/container-toolkit@sha256:ef2a0ef6bbf9c43529da3730974de9d51b8436c2314a68e718d437e6ab7c4b58
image: nvcr.io/nvidia/k8s/container-toolkit:v1.18.1@sha256:ef2a0ef6bbf9c43529da3730974de9d51b8436c2314a68e718d437e6ab7c4b58
- name: driver-image
image: nvcr.io/nvidia/driver@sha256:838f50e304e8880851bae205edc6b781a251b5912267a2eed21661211db8e087
- name: driver-image-570
image: nvcr.io/nvidia/driver@sha256:ef9856ae8491b376364df1f0cad388bcf9983bd2b6c78000523c13536cf828c3
- name: driver-image-535
image: nvcr.io/nvidia/driver@sha256:35359117c5cdf786694d2fdba2ba038e7f673c5d0243c9ed4dc6cdaf6e675e4a
- name: device-plugin-image
image: nvcr.io/nvidia/k8s-device-plugin@sha256:50ac011ab941ab0140d52f56aa0e2fdc553bca96836ab3b26be394fc823fd9e7
image: nvcr.io/nvidia/k8s-device-plugin:v0.18.1@sha256:50ac011ab941ab0140d52f56aa0e2fdc553bca96836ab3b26be394fc823fd9e7
- name: gpu-feature-discovery-image
image: nvcr.io/nvidia/k8s-device-plugin@sha256:50ac011ab941ab0140d52f56aa0e2fdc553bca96836ab3b26be394fc823fd9e7
image: nvcr.io/nvidia/k8s-device-plugin:v0.18.1@sha256:50ac011ab941ab0140d52f56aa0e2fdc553bca96836ab3b26be394fc823fd9e7
- name: mig-manager-image
image: nvcr.io/nvidia/cloud-native/k8s-mig-manager@sha256:8e0803d2f29776cd4cc0501381a20a0b04b2da507a794d66a15894c57beaadb5
image: nvcr.io/nvidia/cloud-native/k8s-mig-manager:v0.13.1@sha256:8e0803d2f29776cd4cc0501381a20a0b04b2da507a794d66a15894c57beaadb5
- name: init-container-image
image: nvcr.io/nvidia/cuda@sha256:d19fe621624c4eb6ac931b8558daa3ecc0c3f07f1e2a52e0267e083d22dceade
image: nvcr.io/nvidia/cuda:13.0.1-base-ubi9@sha256:d19fe621624c4eb6ac931b8558daa3ecc0c3f07f1e2a52e0267e083d22dceade
- name: gpu-operator-validator-image
image: ghcr.io/nvidia/gpu-operator:main-latest
- name: k8s-driver-manager-image
image: nvcr.io/nvidia/cloud-native/k8s-driver-manager@sha256:c549346eb993fda62e9bf665aabaacc88abc06b0b24e69635427d4d71c2d5ed4
image: nvcr.io/nvidia/cloud-native/k8s-driver-manager:v0.9.1@sha256:c549346eb993fda62e9bf665aabaacc88abc06b0b24e69635427d4d71c2d5ed4
# TODO: update to a k8s-driver-manager image from nvcr.io once the next version is published
# TODO: Add Renovate rule to update this image to the values.yaml image
- name: vfio-manager-image
image: ghcr.io/nvidia/k8s-driver-manager:69eec274
- name: sandbox-device-plugin-image
image: nvcr.io/nvidia/kubevirt-gpu-device-plugin@sha256:119de9a331a47203858b99901f44d0c4a8052961b4e60327f4b100d0ab8c9df0
image: nvcr.io/nvidia/kubevirt-gpu-device-plugin:v1.4.0@sha256:119de9a331a47203858b99901f44d0c4a8052961b4e60327f4b100d0ab8c9df0
- name: vgpu-device-manager-image
image: nvcr.io/nvidia/cloud-native/vgpu-device-manager@sha256:098c01e11589e08ede9ffb3002d1c3dff424f0f0c5d1bfcbfd54a359073f16dd
image: nvcr.io/nvidia/cloud-native/vgpu-device-manager:v0.4.1@sha256:098c01e11589e08ede9ffb3002d1c3dff424f0f0c5d1bfcbfd54a359073f16dd
- name: gdrcopy-image
image: nvcr.io/nvidia/cloud-native/gdrdrv@sha256:5c4e61f7ba83d7a64ff2523d447c209ce5bde1ddc79acaf1f32f19620b4912d6
image: nvcr.io/nvidia/cloud-native/gdrdrv:v2.5.1@sha256:5c4e61f7ba83d7a64ff2523d447c209ce5bde1ddc79acaf1f32f19620b4912d6
customresourcedefinitions:
owned:
- name: nvidiadrivers.nvidia.com
Expand Down Expand Up @@ -920,36 +921,37 @@ spec:
- name: "VALIDATOR_IMAGE"
value: "ghcr.io/nvidia/gpu-operator:main-latest"
- name: "GFD_IMAGE"
value: "nvcr.io/nvidia/k8s-device-plugin@sha256:50ac011ab941ab0140d52f56aa0e2fdc553bca96836ab3b26be394fc823fd9e7"
value: "nvcr.io/nvidia/k8s-device-plugin:v0.18.1@sha256:50ac011ab941ab0140d52f56aa0e2fdc553bca96836ab3b26be394fc823fd9e7"
- name: "CONTAINER_TOOLKIT_IMAGE"
value: "nvcr.io/nvidia/k8s/container-toolkit@sha256:ef2a0ef6bbf9c43529da3730974de9d51b8436c2314a68e718d437e6ab7c4b58"
value: "nvcr.io/nvidia/k8s/container-toolkit:v1.18.1@sha256:ef2a0ef6bbf9c43529da3730974de9d51b8436c2314a68e718d437e6ab7c4b58"
- name: "DCGM_IMAGE"
value: "nvcr.io/nvidia/cloud-native/dcgm@sha256:99187d6b023689f50cf065c77b96ba5aacfa26a618854608a1e31da5e826b765"
value: "nvcr.io/nvidia/cloud-native/dcgm:4.4.2-1-ubi9@sha256:99187d6b023689f50cf065c77b96ba5aacfa26a618854608a1e31da5e826b765"
- name: "DCGM_EXPORTER_IMAGE"
value: "nvcr.io/nvidia/k8s/dcgm-exporter@sha256:7c0ac4430bb0a5868b7404a0e06c47e02b0375b61aadd614385ad0bc2d43815a"
value: "nvcr.io/nvidia/k8s/dcgm-exporter:4.4.2-4.7.0-distroless@sha256:7c0ac4430bb0a5868b7404a0e06c47e02b0375b61aadd614385ad0bc2d43815a"
- name: "DEVICE_PLUGIN_IMAGE"
value: "nvcr.io/nvidia/k8s-device-plugin@sha256:50ac011ab941ab0140d52f56aa0e2fdc553bca96836ab3b26be394fc823fd9e7"
value: "nvcr.io/nvidia/k8s-device-plugin:v0.18.1@sha256:50ac011ab941ab0140d52f56aa0e2fdc553bca96836ab3b26be394fc823fd9e7"
- name: "DRIVER_IMAGE"
value: "nvcr.io/nvidia/driver@sha256:838f50e304e8880851bae205edc6b781a251b5912267a2eed21661211db8e087"
- name: "DRIVER_IMAGE-570"
value: "nvcr.io/nvidia/driver@sha256:ef9856ae8491b376364df1f0cad388bcf9983bd2b6c78000523c13536cf828c3"
- name: "DRIVER_IMAGE-535"
value: "nvcr.io/nvidia/driver@sha256:35359117c5cdf786694d2fdba2ba038e7f673c5d0243c9ed4dc6cdaf6e675e4a"
- name: "DRIVER_MANAGER_IMAGE"
value: "nvcr.io/nvidia/cloud-native/k8s-driver-manager@sha256:c549346eb993fda62e9bf665aabaacc88abc06b0b24e69635427d4d71c2d5ed4"
value: "nvcr.io/nvidia/cloud-native/k8s-driver-manager:v0.9.1@sha256:c549346eb993fda62e9bf665aabaacc88abc06b0b24e69635427d4d71c2d5ed4"
- name: "MIG_MANAGER_IMAGE"
value: "nvcr.io/nvidia/cloud-native/k8s-mig-manager@sha256:8e0803d2f29776cd4cc0501381a20a0b04b2da507a794d66a15894c57beaadb5"
value: "nvcr.io/nvidia/cloud-native/k8s-mig-manager:v0.13.1@sha256:8e0803d2f29776cd4cc0501381a20a0b04b2da507a794d66a15894c57beaadb5"
- name: "CUDA_BASE_IMAGE"
value: "nvcr.io/nvidia/cuda@sha256:d19fe621624c4eb6ac931b8558daa3ecc0c3f07f1e2a52e0267e083d22dceade"
value: "nvcr.io/nvidia/cuda:13.0.1-base-ubi9@sha256:d19fe621624c4eb6ac931b8558daa3ecc0c3f07f1e2a52e0267e083d22dceade"
# TODO: update to a k8s-driver-manager image from nvcr.io once the next version is published
# Add Renovate rule to update this image to the values.yaml image
- name: "VFIO_MANAGER_IMAGE"
value: "ghcr.io/nvidia/k8s-driver-manager:69eec274"
- name: "SANDBOX_DEVICE_PLUGIN_IMAGE"
value: "nvcr.io/nvidia/kubevirt-gpu-device-plugin@sha256:119de9a331a47203858b99901f44d0c4a8052961b4e60327f4b100d0ab8c9df0"
value: "nvcr.io/nvidia/kubevirt-gpu-device-plugin:v1.4.0@sha256:119de9a331a47203858b99901f44d0c4a8052961b4e60327f4b100d0ab8c9df0"
- name: "VGPU_DEVICE_MANAGER_IMAGE"
value: "nvcr.io/nvidia/cloud-native/vgpu-device-manager@sha256:098c01e11589e08ede9ffb3002d1c3dff424f0f0c5d1bfcbfd54a359073f16dd"
value: "nvcr.io/nvidia/cloud-native/vgpu-device-manager:v0.4.1@sha256:098c01e11589e08ede9ffb3002d1c3dff424f0f0c5d1bfcbfd54a359073f16dd"
- name: "GDRCOPY_IMAGE"
value: "nvcr.io/nvidia/cloud-native/gdrdrv@sha256:5c4e61f7ba83d7a64ff2523d447c209ce5bde1ddc79acaf1f32f19620b4912d6"
value: "nvcr.io/nvidia/cloud-native/gdrdrv:v2.5.1@sha256:5c4e61f7ba83d7a64ff2523d447c209ce5bde1ddc79acaf1f32f19620b4912d6"
terminationGracePeriodSeconds: 10
volumes:
- hostPath:
Expand Down
2 changes: 1 addition & 1 deletion deployments/gpu-operator/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -268,7 +268,7 @@ dcgm:
enabled: false
repository: nvcr.io/nvidia/cloud-native
image: dcgm
version: 4.4.2-1-ubuntu22.04
version: 4.4.2-1-ubi9
imagePullPolicy: IfNotPresent
args: []
env: []
Expand Down