Builds and OCI images

Documentation home · Release procedure

All images build in GitLab CI through the established TLSPU container templates. There are no local builds, test stages, shared test-artifact images or custom build/publication script overrides in this repository.

Image layout

Registry prefix:

registry.gitlab.com/tak-os-platform/tak-os-containers/tak-os-replicated-csi

For release 4.1.1, the image references end in /manager:4.1.1, /node:4.1.1 and /replica:4.1.1 after tag-pipeline publication. Kubernetes supplies the command explicitly. The manager retains the legacy node-controller entry point, but 4.1.0 no longer generates those Pods. The node image also runs the mount owner and shared replica host. No additional image is needed for those roles.

Each multi-stage Dockerfile compiles one statically linked binary with CGO_ENABLED=0, using golang:alpine, then copies that binary and its licence materials into scratch. No shell, package manager or mount helper is present at runtime. alpine:latest is the floating Alpine base where appropriate; build/base versions are not locked in repository configuration.

Floating inputs

The committed go.mod declares only tak-os-replicated-csi. CI resolves the current Go toolchain with go@latest and discovers current direct dependencies through their imported packages, honoring their published transitive dependency graph. There is no committed go.sum, pinned Go version or fixed dependency set. Forcing every transitive module to an unrelated newest development revision can break upstream compatibility and is not part of this build.

The TLSPU BUILDVARS interface passes CI_JOB_ID. Each job uses that value in the dependency/build layer so a rebuild resolves inputs afresh. The builder also upgrades Alpine packages and removes its disposable Go build cache before legacy Docker exports the intermediate layer. This avoids carrying the compiler cache into that export and into a race with cache housekeeping.

The TLSPU template used for 3.3.0 invokes Docker without --pull; refreshing a cached base image is controlled by that shared template/runner. This repository does not override the command. A later shared-template change is inherited. Static scratch runtimes contain no inherited Alpine OS packages.

CI jobs and tags

Build jobs extend only .container-build; manifest jobs extend only .container-manifest. Local job definitions provide image name, Dockerfile, context and permitted build variables. Authentication, architecture selection, Docker build/push and manifest publication come from the current unpinned tlspu/ci-utils include. No local script, before_script or hidden-template override is used.

The shared template maps master/main to latest, builds architecture-specific tags, then publishes the final role tags during manifest assembly. Enabled architectures come from that template, not an inferred portability promise. A failed build stage can leave manifest jobs skipped; image availability is confirmed by the manifest results, not just a successful compile.

Build information and licences

Each image contains /licenses/buildinfo.txt, the executable's actual Go module and compiler information; module notices; corresponding HashiCorp module source archives; the project licence; and standard-library notices. The collector uses versions selected in that build rather than hard-coded dependency versions.

A tag identifies source history, not a reproducible dependency/image promise. Record the actual running image identity and build information for support. Historical source-bound results do not verify a newly resolved dependency set. Unsigned containers are intentional; see release policy.

The 3.3.0 tag pipeline completed all six build/manifest jobs. This is publication evidence, not a new runtime result or permission to change either cluster.

The 4.0.1 tag pipeline records publication for the previous credential-renewal release. Tag creation alone is not confirmation that all role manifests have been published. The 4.1.0 tag pipeline is the publication record for the shared-runtime release; staging promotion must wait for all three role manifests and companion local CSI 2.1.0 publication.

The 4.1.1 tag pipeline publishes the documentation patch release with unchanged runtime source. Its image publication is unconfirmed at release preparation; floating build inputs still resolve afresh. No new runtime observation or deployment is included.