Updating pipeline images

How to update the container images used in the pipeline

The pipeline uses container images from the container image repository.

SHA-locked CI images

Repos pin CI image digests in .gitlab-ci.yml or .gitlab/ci_templates/ci-images.yml:

variables:
  cki_tools_image_tag: production@sha256:<digest>
  buildah_image_tag: production@sha256:<digest>

Renovate auto-updates these digests; mr-auto-approver approves the resulting MRs. No manual intervention is needed for routine CI image updates.

Some repos use the separate ci-images.yml file specifically for CODEOWNERS exclusion – this lets Renovate digest updates merge without requiring review from CI config owners.

pipeline-definition Python deps

Pipeline Python dependencies use lockfiles (requirements-python.lock, requirements-builder.lock), generated by the post-upgrade.sh ConfigMap script into pipeline/requirements-lock.yml. See Lockfiles for details.

Automatic vs manual updates

Automatic (no intervention needed)

  • Renovate digest updates for CI image references in all repos
  • RPM lockfile maintenance (automerge)
  • Python lockfile updates (auto-MR, manual approve)
  • Base image version bumps (within the allowedVersions Fedora cap)

Manual intervention needed

  • Bumping the Fedora allowedVersions cap in the cki-lib preset
  • Adding new images to the CI build matrix
  • Tagging :production on containers-repo builder/python images (see below)
  • Troubleshooting Renovate failures (stale lockfiles, branch conflicts)
  • Approving Python dependency MRs

Steps to update containers-repo images via MR

The manual :production tagging steps below apply only to containers repo images (builder-*, python) that use manual tagging. Service images (cki-tools, datawarehouse, reporter) deploy automatically on the default branch – no manual :production tag step needed.

  1. On the merge request in the container image repository, check that the merge commit used for the latest pipeline includes all changes from the target branch as well.
  2. Trigger the bot for the container images that should be updated via @cki-ci-bot please test.
  3. Wait for the pipelines to finish and verify everything is correct.
  4. Request a review of the merge request.
  5. After approval, create the :production tags for the verified container images by clicking on the corresponding little arrows in the environment list.

Steps to update containers-repo images without MR

  1. Trigger a new pipeline via the pipelines page in the container image repository. After clicking on Run pipeline, optionally limit the pipeline to a certain container image by setting the ONLY_JOB_NAME variable to the name of the container image that should be updated, e.g. builder-stream9.
  2. Wait for the parent and child pipelines to finish and verify everything is correct.
  3. In a merge request in any cki-project project with the cki-ci-bot enabled, trigger the bot for the container images with the ID of the parent pipeline via @cki-ci-bot please test [image_tag=g-123456789].
  4. Wait for the pipelines to finish and verify everything is correct.
  5. Create the :production tags for the verified container images by clicking on the corresponding manual public-tag and internal-tag jobs.