chore: use library prefix for securebuild images and add missing k0s core images

.github/workflows/dependencies.yaml

@@ -31,8 +31,7 @@ jobs:
           K0S_MINOR_VERSION=$(make print-K0S_MINOR_VERSION)
         fi
         echo "k0s minor version: $K0S_MINOR_VERSION"
-        ./scripts/k0s-update-dependencies.sh "$K0S_MINOR_VERSION" \
-          UPDATE_ALL_IMAGES=true
+        ./scripts/k0s-update-dependencies.sh "$K0S_MINOR_VERSION"
 
     - name: Troubleshoot
       env:

.github/workflows/image-deps-updater.yaml

@@ -145,8 +145,7 @@ jobs:
           if [ -n "${{ github.event.inputs.k0s_minor_version }}" ]; then
             k0s_minor_version="${{ github.event.inputs.k0s_minor_version }}"
           fi
-          ./scripts/k0s-update-images.sh "$k0s_minor_version" \
-            UPDATE_ALL_IMAGES=true
+          UPDATE_ALL_IMAGES=true ./scripts/k0s-update-images.sh "$k0s_minor_version"
 
       - name: Determine target branch
         id: determine-target

cmd/buildtools/adminconsole.go

@@ -58,10 +58,12 @@ var updateAdminConsoleAddonCommand = &cli.Command{
 			return nil
 		}
 
-		upstream := "registry.replicated.com/library/admin-console"
+		upstream := "proxy.replicated.com/library/admin-console"
+		withproto := fmt.Sprintf("oci://%s", upstream)
+
 		newmeta := release.AddonMetadata{
 			Version:  latest,
-			Location: fmt.Sprintf("oci://proxy.replicated.com/anonymous/%s", upstream),
+			Location: withproto,
 			Images:   make(map[string]release.AddonImage),
 		}
 
@@ -71,7 +73,6 @@ var updateAdminConsoleAddonCommand = &cli.Command{
 		}
 
 		logrus.Infof("extracting images from chart")
-		withproto := fmt.Sprintf("oci://%s", upstream)
 		images, err := helm.ExtractImagesFromChart(hcli, withproto, latest, values)
 		if err != nil {
 			return fmt.Errorf("failed to get images from admin console chart: %w", err)

cmd/buildtools/embeddedclusteroperator.go

@@ -18,11 +18,11 @@ var operatorImageComponents = map[string]addonComponent{
 		name:             "embedded-cluster-operator",
 		useUpstreamImage: true,
 	},
-	"registry.replicated.com/library/embedded-cluster-utils": {
+	"proxy.replicated.com/library/embedded-cluster-utils": {
 		name:             "utils",
 		useUpstreamImage: true,
 	},
-	"registry.replicated.com/library/goldpinger": {
+	"proxy.replicated.com/library/goldpinger": {
 		name:             "goldpinger",
 		useUpstreamImage: true,
 	},
@@ -64,11 +64,11 @@ var updateOperatorAddonCommand = &cli.Command{
 		if chartURL != "" {
 			logrus.Infof("using input override from INPUT_OPERATOR_CHART_URL: %s", chartURL)
 			chartURL = strings.TrimPrefix(chartURL, "oci://")
-			chartURL = strings.TrimPrefix(chartURL, "proxy.replicated.com/anonymous/")
 		} else {
-			chartURL = "registry.replicated.com/library/embedded-cluster-operator"
+			chartURL = "proxy.replicated.com/library/embedded-cluster-operator"
 		}
-		chartURL = fmt.Sprintf("oci://proxy.replicated.com/anonymous/%s", chartURL)
+		chartURL = addProxyAnonymousPrefix(chartURL)
+		chartURL = fmt.Sprintf("oci://%s", chartURL)
 
 		imageOverride := os.Getenv("INPUT_OPERATOR_IMAGE")
 		if imageOverride != "" {
@@ -118,6 +118,8 @@ var updateOperatorImagesCommand = &cli.Command{
 }
 
 func updateOperatorAddonImages(ctx context.Context, hcli helm.Client, chartURL string, chartVersion string, filteredImages []string) error {
+	chartURL = replaceReplicatedLibraryPrefix(chartURL)
+
 	newmeta := release.AddonMetadata{
 		Version:  chartVersion,
 		Location: chartURL,
@@ -136,8 +138,8 @@ func updateOperatorAddonImages(ctx context.Context, hcli helm.Client, chartURL s
 	}
 
 	// make sure we include the operator util and goldpinger images as they don't show up when rendering the helm chart.
-	images = append(images, "registry.replicated.com/library/embedded-cluster-utils:latest")
-	images = append(images, "registry.replicated.com/library/goldpinger:latest")
+	images = append(images, "proxy.replicated.com/library/embedded-cluster-utils:latest")
+	images = append(images, "proxy.replicated.com/library/goldpinger:latest")
 
 	metaImages, err := UpdateImages(ctx, operatorImageComponents, embeddedclusteroperator.Metadata.Images, images, filteredImages)
 	if err != nil {

cmd/buildtools/k0s.go

@@ -18,7 +18,7 @@ var k0sImageComponents = map[string]addonComponent{
 	"quay.io/k0sproject/coredns": {
 		name: "coredns",
 		getCustomImageName: func(opts addonComponentOptions) (string, error) {
-			ref := "registry.replicated.com/library/coredns"
+			ref := "proxy.replicated.com/library/coredns"
 			return getLatestImageNameAndTag(opts.ctx, ref, nil)
 		},
 	},
@@ -29,7 +29,7 @@ var k0sImageComponents = map[string]addonComponent{
 			if err != nil {
 				return "", fmt.Errorf("failed to get calico release: %w", err)
 			}
-			return fmt.Sprintf("registry.replicated.com/library/calico-node:%s", tag), nil
+			return fmt.Sprintf("proxy.replicated.com/library/calico-node:%s", tag), nil
 		},
 	},
 	"quay.io/k0sproject/calico-cni": {
@@ -39,7 +39,7 @@ var k0sImageComponents = map[string]addonComponent{
 			if err != nil {
 				return "", fmt.Errorf("failed to get calico tag: %w", err)
 			}
-			return fmt.Sprintf("registry.replicated.com/library/calico-cni:%s", tag), nil
+			return fmt.Sprintf("proxy.replicated.com/library/calico-cni:%s", tag), nil
 		},
 	},
 	"quay.io/k0sproject/calico-kube-controllers": {
@@ -49,27 +49,27 @@ var k0sImageComponents = map[string]addonComponent{
 			if err != nil {
 				return "", fmt.Errorf("failed to get calico tag: %w", err)
 			}
-			return fmt.Sprintf("registry.replicated.com/library/calico-kube-controllers:%s", tag), nil
+			return fmt.Sprintf("proxy.replicated.com/library/calico-kube-controllers:%s", tag), nil
 		},
 	},
 	"registry.k8s.io/metrics-server/metrics-server": {
 		name: "metrics-server",
 		getCustomImageName: func(opts addonComponentOptions) (string, error) {
-			ref := "registry.replicated.com/library/metrics-server"
+			ref := "proxy.replicated.com/library/metrics-server"
 			return getLatestImageNameAndTag(opts.ctx, ref, nil)
 		},
 	},
 	"quay.io/k0sproject/metrics-server": {
 		name: "metrics-server",
 		getCustomImageName: func(opts addonComponentOptions) (string, error) {
-			ref := "registry.replicated.com/library/metrics-server"
+			ref := "proxy.replicated.com/library/metrics-server"
 			return getLatestImageNameAndTag(opts.ctx, ref, nil)
 		},
 	},
 	"quay.io/k0sproject/kube-proxy": {
 		name: "kube-proxy",
 		getCustomImageName: func(opts addonComponentOptions) (string, error) {
-			ref := "registry.replicated.com/library/kube-proxy"
+			ref := "proxy.replicated.com/library/kube-proxy"
 			constraints := mustParseSemverConstraints(latestPatchConstraint(opts.upstreamVersion))
 			return getLatestImageNameAndTag(opts.ctx, ref, constraints)
 		},
@@ -79,8 +79,9 @@ var k0sImageComponents = map[string]addonComponent{
 	"quay.io/k0sproject/envoy-distroless": {
 		name: "envoy-distroless",
 		getCustomImageName: func(opts addonComponentOptions) (string, error) {
-			ref := "registry.replicated.com/library/envoy"
-			return getLatestImageNameAndTag(opts.ctx, ref, nil)
+			ref := "proxy.replicated.com/library/envoy"
+			constraints := mustParseSemverConstraints(latestPatchConstraint(opts.upstreamVersion))
+			return getLatestImageNameAndTag(opts.ctx, ref, constraints)
 		},
 	},
 }
@@ -95,7 +96,7 @@ var pauseComponent = addonComponent{
 			return "", fmt.Errorf("failed to parse pause version: %w", err)
 		}
 
-		ref := "registry.replicated.com/library/pause"
+		ref := "proxy.replicated.com/library/pause"
 		constraints := mustParseSemverConstraints(latestPatchConstraint(sv))
 		return getLatestImageNameAndTag(opts.ctx, ref, constraints)
 	},

cmd/buildtools/openebs.go

@@ -24,7 +24,7 @@ var openebsImageComponents = map[string]addonComponent{
 	"docker.io/openebs/provisioner-localpv": {
 		name: "openebs-provisioner-localpv",
 		getCustomImageName: func(opts addonComponentOptions) (string, error) {
-			ref := "registry.replicated.com/library/openebs-provisioner-localpv"
+			ref := "proxy.replicated.com/library/openebs-provisioner-localpv"
 			constraints := mustParseSemverConstraints(latestPatchConstraint(opts.upstreamVersion))
 			return getLatestImageNameAndTag(opts.ctx, ref, constraints)
 		},
@@ -33,7 +33,7 @@ var openebsImageComponents = map[string]addonComponent{
 	"docker.io/openebs/linux-utils": {
 		name: "openebs-linux-utils",
 		getCustomImageName: func(opts addonComponentOptions) (string, error) {
-			ref := "registry.replicated.com/library/openebs-linux-utils"
+			ref := "proxy.replicated.com/library/openebs-linux-utils"
 			constraints := mustParseSemverConstraints(latestPatchConstraint(opts.upstreamVersion))
 			return getLatestImageNameAndTag(opts.ctx, ref, constraints)
 		},
@@ -42,7 +42,7 @@ var openebsImageComponents = map[string]addonComponent{
 	"docker.io/bitnamilegacy/kubectl": {
 		name: "kubectl",
 		getCustomImageName: func(opts addonComponentOptions) (string, error) {
-			ref := "registry.replicated.com/library/kubectl"
+			ref := "proxy.replicated.com/library/kubectl"
 			constraints := mustParseSemverConstraints(latestPatchConstraint(opts.upstreamVersion))
 			return getLatestImageNameAndTag(opts.ctx, ref, constraints)
 		},
@@ -51,7 +51,7 @@ var openebsImageComponents = map[string]addonComponent{
 	"docker.io/openebs/kubectl": {
 		name: "kubectl",
 		getCustomImageName: func(opts addonComponentOptions) (string, error) {
-			ref := "registry.replicated.com/library/kubectl"
+			ref := "proxy.replicated.com/library/kubectl"
 			return getLatestImageNameAndTag(opts.ctx, ref, nil)
 		},
 		upstreamVersionInputOverride: "INPUT_KUBECTL_VERSION",
@@ -97,7 +97,8 @@ var updateOpenEBSAddonCommand = &cli.Command{
 		}
 
 		upstream := fmt.Sprintf("%s/openebs", os.Getenv("CHARTS_DESTINATION"))
-		withproto := fmt.Sprintf("oci://proxy.replicated.com/anonymous/%s", upstream)
+		upstream = addProxyAnonymousPrefix(upstream)
+		withproto := fmt.Sprintf("oci://%s", upstream)
 
 		linuxUtilsVersion, err := findOpenEBSLinuxUtilsVersionFromChart(hcli, withproto, nextChartVersion)
 		if err != nil {

cmd/buildtools/registry.go

@@ -24,7 +24,7 @@ var registryImageComponents = map[string]addonComponent{
 	"docker.io/library/registry": {
 		name: "registry",
 		getCustomImageName: func(opts addonComponentOptions) (string, error) {
-			ref := "registry.replicated.com/library/registry"
+			ref := "proxy.replicated.com/library/registry"
 			// TODO: unpin this
 			return fmt.Sprintf("%s:%s", ref, "2.8.3"), nil
 			// constraints := mustParseSemverConstraints(latestPatchConstraint(opts.upstreamVersion))
@@ -73,7 +73,8 @@ var updateRegistryAddonCommand = &cli.Command{
 		}
 
 		upstream := fmt.Sprintf("%s/docker-registry", os.Getenv("CHARTS_DESTINATION"))
-		withproto := fmt.Sprintf("oci://proxy.replicated.com/anonymous/%s", upstream)
+		upstream = addProxyAnonymousPrefix(upstream)
+		withproto := fmt.Sprintf("oci://%s", upstream)
 
 		logrus.Infof("updating registry images")
 

cmd/buildtools/seaweedfs.go

@@ -23,7 +23,7 @@ var seaweedfsImageComponents = map[string]addonComponent{
 	"docker.io/chrislusf/seaweedfs": {
 		name: "seaweedfs",
 		getCustomImageName: func(opts addonComponentOptions) (string, error) {
-			ref := "registry.replicated.com/library/seaweedfs"
+			ref := "proxy.replicated.com/library/seaweedfs"
 			constraints := mustParseSemverConstraints(latestPatchConstraint(opts.upstreamVersion))
 			return getLatestImageNameAndTag(opts.ctx, ref, constraints)
 		},
@@ -70,7 +70,8 @@ var updateSeaweedFSAddonCommand = &cli.Command{
 		}
 
 		upstream := fmt.Sprintf("%s/seaweedfs", os.Getenv("CHARTS_DESTINATION"))
-		withproto := fmt.Sprintf("oci://proxy.replicated.com/anonymous/%s", upstream)
+		upstream = addProxyAnonymousPrefix(upstream)
+		withproto := fmt.Sprintf("oci://%s", upstream)
 
 		logrus.Infof("updating seaweedfs images")
 

cmd/buildtools/utils.go

@@ -568,3 +568,7 @@ func addProxyAnonymousPrefix(image string) string {
 	}
 	return fmt.Sprintf("proxy.replicated.com/anonymous/%s", image)
 }
+
+func replaceReplicatedLibraryPrefix(image string) string {
+	return strings.Replace(image, "proxy.replicated.com/anonymous/registry.replicated.com/library", "proxy.replicated.com/library", 1)
+}

cmd/buildtools/velero.go

@@ -25,7 +25,7 @@ var veleroImageComponents = map[string]addonComponent{
 	"docker.io/velero/velero": {
 		name: "velero",
 		getCustomImageName: func(opts addonComponentOptions) (string, error) {
-			ref := "registry.replicated.com/library/velero"
+			ref := "proxy.replicated.com/library/velero"
 			constraints := mustParseSemverConstraints(latestPatchConstraint(opts.upstreamVersion))
 			return getLatestImageNameAndTag(opts.ctx, ref, constraints)
 		},
@@ -34,7 +34,7 @@ var veleroImageComponents = map[string]addonComponent{
 	"docker.io/velero/velero-plugin-for-aws": {
 		name: "velero-plugin-for-aws",
 		getCustomImageName: func(opts addonComponentOptions) (string, error) {
-			ref := "registry.replicated.com/library/velero-plugin-for-aws"
+			ref := "proxy.replicated.com/library/velero-plugin-for-aws"
 			constraints := mustParseSemverConstraints(latestPatchConstraint(opts.upstreamVersion))
 			return getLatestImageNameAndTag(opts.ctx, ref, constraints)
 		},
@@ -43,7 +43,7 @@ var veleroImageComponents = map[string]addonComponent{
 	"docker.io/bitnamilegacy/kubectl": {
 		name: "kubectl",
 		getCustomImageName: func(opts addonComponentOptions) (string, error) {
-			ref := "registry.replicated.com/library/kubectl"
+			ref := "proxy.replicated.com/library/kubectl"
 			return getLatestImageNameAndTag(opts.ctx, ref, nil)
 		},
 		upstreamVersionInputOverride: "INPUT_KUBECTL_VERSION",
@@ -93,7 +93,8 @@ var updateVeleroAddonCommand = &cli.Command{
 		}
 
 		upstream := fmt.Sprintf("%s/velero", os.Getenv("CHARTS_DESTINATION"))
-		withproto := fmt.Sprintf("oci://proxy.replicated.com/anonymous/%s", upstream)
+		upstream = addProxyAnonymousPrefix(upstream)
+		withproto := fmt.Sprintf("oci://%s", upstream)
 
 		veleroVersion, err := findVeleroVersionFromChart(c.Context, hcli, withproto, nextChartVersion)
 		if err != nil {

e2e/cluster/cmx/cluster.go

@@ -145,7 +145,7 @@ func NewNodes(in *ClusterInput) ([]Node, error) {
 
 		privateIP, err := discoverPrivateIP(nodes[i])
 		if err != nil {
-			return nil, fmt.Errorf("discover node private IP: %v", err)
+			return nodes, fmt.Errorf("discover node private IP: %v", err)
 		}
 		nodes[i].privateIP = privateIP
 

pkg/addons/adminconsole/static/metadata.yaml

@@ -6,7 +6,7 @@
 # $ output/bin/buildtools update addon <addon name>
 #
 version: 1.128.1-ec.0
-location: oci://proxy.replicated.com/anonymous/registry.replicated.com/library/admin-console
+location: oci://proxy.replicated.com/library/admin-console
 images:
     kotsadm:
         repo: proxy.replicated.com/anonymous/kotsadm/kotsadm

pkg/addons/embeddedclusteroperator/static/metadata.yaml

@@ -6,20 +6,20 @@
 # $ output/bin/buildtools update addon <addon name>
 #
 version: 1.19.0+k8s-1.30
-location: oci://proxy.replicated.com/anonymous/registry.replicated.com/library/embedded-cluster-operator
+location: oci://proxy.replicated.com/library/embedded-cluster-operator
 images:
     embedded-cluster-operator:
         repo: proxy.replicated.com/anonymous/replicated/embedded-cluster-operator-image
         tag:
             amd64: v1.19.0-k8s-1.30
             arm64: v1.19.0-k8s-1.30
     goldpinger:
-        repo: proxy.replicated.com/anonymous/registry.replicated.com/library/goldpinger
+        repo: proxy.replicated.com/library/goldpinger
         tag:
             amd64: latest
             arm64: latest
     utils:
-        repo: proxy.replicated.com/anonymous/registry.replicated.com/library/embedded-cluster-utils
+        repo: proxy.replicated.com/library/embedded-cluster-utils
         tag:
             amd64: latest
             arm64: latest

pkg/addons/openebs/static/metadata.yaml

@@ -9,17 +9,17 @@ version: 4.3.3
 location: oci://proxy.replicated.com/anonymous/registry.replicated.com/ec-charts/openebs
 images:
     kubectl:
-        repo: proxy.replicated.com/anonymous/registry.replicated.com/library/kubectl
+        repo: proxy.replicated.com/library/kubectl
         tag:
             amd64: 1.33.4-amd64@sha256:139e35f89e2ea78101e80f2d021219e10fd076e259bb4ce84f81e473647b59fa
             arm64: 1.33.4-arm64@sha256:387204cae55a49a856ac7a5ac626fafb1042ff3f4548297850ca1d9b5dfac5b7
     openebs-linux-utils:
-        repo: proxy.replicated.com/anonymous/registry.replicated.com/library/openebs-linux-utils
+        repo: proxy.replicated.com/library/openebs-linux-utils
         tag:
             amd64: 4.2.0-amd64@sha256:7aceec594f33cc0f1fa5c30762ea39a824de6f27f7fea3d52a9021bbcf974b7f
             arm64: 4.2.0-arm64@sha256:2fbb059685fc5f76339090dfb9fbbe02c2b6176d72122d7eefe7926ae1e087e3
     openebs-provisioner-localpv:
-        repo: proxy.replicated.com/anonymous/registry.replicated.com/library/openebs-provisioner-localpv
+        repo: proxy.replicated.com/library/openebs-provisioner-localpv
         tag:
             amd64: 4.3.0-amd64@sha256:0837e2fec03e7f8d119487a4133310cf9a0028a90061045b672607f7b18d1280
             arm64: 4.3.0-arm64@sha256:b3d128e5a9b21c848f84055d2618be58d18b9234afb4d296ab413e247be08892

pkg/addons/openebs/static/values.tpl.yaml

@@ -13,8 +13,8 @@ localpv-provisioner:
 {{- if .ReplaceImages }}
   helperPod:
     image:
-      registry: proxy.replicated.com/anonymous/
-      repository: '{{ TrimPrefix "proxy.replicated.com/anonymous/" (index .Images "openebs-linux-utils").Repo }}'
+      registry: proxy.replicated.com/
+      repository: '{{ TrimPrefix "proxy.replicated.com/" (index .Images "openebs-linux-utils").Repo }}'
       tag: '{{ index (index .Images "openebs-linux-utils").Tag .GOARCH }}'
 {{- end }}
   hostpathClass:
@@ -23,8 +23,8 @@ localpv-provisioner:
   localpv:
 {{- if .ReplaceImages }}
     image:
-      registry: proxy.replicated.com/anonymous/
-      repository: '{{ TrimPrefix "proxy.replicated.com/anonymous/" (index .Images "openebs-provisioner-localpv").Repo }}'
+      registry: proxy.replicated.com/
+      repository: '{{ TrimPrefix "proxy.replicated.com/" (index .Images "openebs-provisioner-localpv").Repo }}'
       tag: '{{ index (index .Images "openebs-provisioner-localpv").Tag .GOARCH }}'
 {{- end }}
     basePath: "/var/lib/embedded-cluster/openebs-local"
@@ -42,8 +42,8 @@ mayastor:
 {{- if .ReplaceImages }}
 preUpgradeHook:
   image:
-    registry: proxy.replicated.com/anonymous
-    repo: '{{ TrimPrefix "proxy.replicated.com/anonymous/" (index .Images "kubectl").Repo }}'
+    registry: proxy.replicated.com
+    repo: '{{ TrimPrefix "proxy.replicated.com/" (index .Images "kubectl").Repo }}'
     tag: '{{ index (index .Images "kubectl").Tag .GOARCH }}'
 {{- end }}
 zfs-localpv: