use version tag

2026-07-02 09:44:37 -07:00
1 parent e3d63a1cb4
commit ff536f40a2
@@ -87,6 +87,27 @@ keys in your values file are harmless (ignored).
 block and merge into your install unless you override them. Set them explicitly if you relied on
 different values (e.g. a non-production `NODE_ENV`).

+### Image tags follow the chart's `appVersion`
+
+Each tier's `image` value is now the repository **without a tag**; the tag defaults to the chart's
+`appVersion`, so the client, api, worker, and mongodb images all move together when you upgrade the
+chart. You can still pin per tier:
+
+```yaml
+api:
+  image: ghcr.io/bluewave-labs/checkmate-backend   # repo only
+  tag: ""            # empty → Chart.appVersion; set e.g. "v3.1.0" to pin, or "latest" for a dev tag
+```
+
+- `<tier>.tag` overrides the version for that tier. The `worker` tier inherits `api.tag` (and
+  `api.image`) unless you set `worker.tag` / `worker.image`.
+- If you put a **full `repo:tag`** in `image` (e.g. a legacy `server.image: …:v3.2.0` override), it is
+  used verbatim and the `tag` field is ignored — so existing pinned values keep working unchanged.
+
+**Prefer a pinned tag over `latest`.** With the default `imagePullPolicy: IfNotPresent`, `latest` is
+cached per node and never refreshed, and `helm rollback` can't move a floating tag — pin a version (or
+let it default to `appVersion`) for reproducible, rollback-able deploys.
+
 ## Scaling: the worker tier & autoscaling

 By default the chart runs a single all-in-one API pod that both schedules **and** processes monitoring
@@ -14,3 +14,22 @@ then reference `$api.*` instead of `.Values.api.*`.
 {{- end -}}
 {{- $api | toYaml -}}
 {{- end -}}
+
+{{- /*
+Resolve a full image reference from a repo + optional tag. `appVersion` is the single source of
+truth for tags: bumping Chart.appVersion moves every tier at once. Call as:
+  {{ include "checkmate.image" (dict "image" $repo "tag" $tag "root" $) }}
+
+If `image` already carries a tag (a ":" in its final path segment) it is used verbatim — this keeps
+legacy `server.image: repo:tag` overrides working and lets anyone pin a full ref (e.g. tag "latest").
+A ":" only in the registry segment (a registry port like "reg:5000/x") is ignored, so a tag is still
+appended. Otherwise the tag is `tag` if set, else the chart's appVersion.
+*/}}
+{{- define "checkmate.image" -}}
+{{- $lastSegment := .image | splitList "/" | last -}}
+{{- if contains ":" $lastSegment -}}
+{{- .image -}}
+{{- else -}}
+{{- printf "%s:%s" .image (.tag | default .root.Chart.AppVersion) -}}
+{{- end -}}
+{{- end -}}
@@ -23,7 +23,7 @@ spec:
    {{- end }}
      containers:
        - name: api
-          image: {{ $api.image }}
+          image: {{ include "checkmate.image" (dict "image" $api.image "tag" $api.tag "root" $) }}
          imagePullPolicy: {{ $api.imagePullPolicy }}
          ports:
            - name: http
@@ -23,7 +23,7 @@ spec:
    {{- end }}
      containers:
        - name: client
-          image: {{ .Values.client.image }}
+          image: {{ include "checkmate.image" (dict "image" .Values.client.image "tag" .Values.client.tag "root" $) }}
          imagePullPolicy: {{ .Values.client.imagePullPolicy }}
          ports:
            - containerPort: {{ .Values.client.port }}
@@ -22,7 +22,7 @@ spec:
    {{- end }}
      containers:
        - name: mongodb
-          image: {{ .Values.mongodb.image }}
+          image: {{ include "checkmate.image" (dict "image" .Values.mongodb.image "tag" .Values.mongodb.tag "root" $) }}
          imagePullPolicy: {{ .Values.mongodb.imagePullPolicy }}
          ports:
            - containerPort: {{ .Values.mongodb.port }}
@@ -27,7 +27,7 @@ spec:
    {{- end }}
      containers:
        - name: worker
-          image: {{ .Values.worker.image | default $api.image }}
+          image: {{ include "checkmate.image" (dict "image" (.Values.worker.image | default $api.image) "tag" (.Values.worker.tag | default $api.tag) "root" $) }}
          imagePullPolicy: {{ .Values.worker.imagePullPolicy | default $api.imagePullPolicy }}
          ports:
            - name: health
@@ -1,5 +1,6 @@
 client:
-  image: ghcr.io/bluewave-labs/checkmate-client:v3.2.0
+  image: ghcr.io/bluewave-labs/checkmate-client
+  tag: "" # defaults to Chart.appVersion; set a full repo:tag in `image` to pin (e.g. a :latest dev tag)
  imagePullPolicy: IfNotPresent # IfNotPresent so kind-loaded :latest images are used (not pulled)
  port: 80
  protocol: http
@@ -19,7 +20,8 @@ client:
      # The secret will be automatically created by cert-manager when using the cert-manager.io/cluster-issuer annotation

 api:
-  image: ghcr.io/bluewave-labs/checkmate-backend:v3.2.0
+  image: ghcr.io/bluewave-labs/checkmate-backend
+  tag: "" # defaults to Chart.appVersion; set a full repo:tag in `image` to pin (e.g. a :latest dev tag)
  imagePullPolicy: IfNotPresent # IfNotPresent so kind-loaded :latest images are used (not pulled)
  port: 52345
  protocol: http
@@ -51,7 +53,8 @@ api:
      # The secret will be automatically created by cert-manager when using the cert-manager.io/cluster-issuer annotation

 mongodb:
-  image: ghcr.io/bluewave-labs/checkmate-mongo:v3.2.0
+  image: ghcr.io/bluewave-labs/checkmate-mongo
+  tag: "" # defaults to Chart.appVersion; set a full repo:tag in `image` to pin
  imagePullPolicy: IfNotPresent # IfNotPresent so kind-loaded :latest images are used (not pulled)
  port: 27017

@@ -61,6 +64,7 @@ worker:
  # API is all-in-one and processes jobs itself.
  enabled: false
  image: "" # defaults to api.image when empty, same as API image
+  tag: "" # defaults to api.tag (-> Chart.appVersion) when empty
  imagePullPolicy: "" # defaults to api.imagePullPolicy when empty
  replicas: 1 # used only when autoscaling.enabled = false
  healthPort: 52346 # HEALTH_PORT; serves /livez /readyz /metrics