Merge pull request #1761 from rackerlabs/understackctl-deploy-image-set

feat(understackctl): add deploy image-set subcommand

Author: cardoe

go/understackctl/cmd/deploy/deploy.go

@@ -36,6 +36,7 @@ func NewCmdDeploy() *cobra.Command {
 	cmd.AddCommand(newCmdDeployRender())
 	cmd.AddCommand(newCmdDeployEnable())
 	cmd.AddCommand(newCmdDeployDisable())
+	cmd.AddCommand(newCmdDeployImageSet())
 
 	return cmd
 }

go/understackctl/cmd/deploy/image_set.go

@@ -0,0 +1,142 @@
+package deploy
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"github.com/charmbracelet/log"
+	"github.com/google/go-containerregistry/pkg/authn"
+	"github.com/google/go-containerregistry/pkg/name"
+	"github.com/google/go-containerregistry/pkg/v1/remote"
+	"github.com/spf13/cobra"
+)
+
+var (
+	imageTagRe = regexp.MustCompile(`([^\s"']+/understack/[^:]+):v[0-9]+\.[0-9]+\.[0-9]+(?:@sha256:[a-f0-9]+)?`)
+	refTagRe   = regexp.MustCompile(`(\?ref=)v[0-9]+\.[0-9]+\.[0-9]+`)
+)
+
+func newCmdDeployImageSet() *cobra.Command {
+	var noDigest bool
+
+	cmd := &cobra.Command{
+		Use:   "image-set <cluster-name> <version>",
+		Short: "Update UnderStack image tags to a new version",
+		Long: `Walk all YAML files in the cluster directory and replace UnderStack image
+references of the form .*/understack/.*:vX.Y.Z[@sha256:...] with the given
+version tag. Also updates ?ref=vX.Y.Z in all kustomization.yaml files.
+
+By default the sha256 digest is resolved from the registry and pinned
+alongside the tag. Use --no-digest to write the tag only.`,
+		Args: cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runDeployImageSet(args[0], args[1], noDigest)
+		},
+	}
+
+	cmd.Flags().BoolVar(&noDigest, "no-digest", false, "Write tag only, skip sha256 digest lookup")
+
+	return cmd
+}
+
+func runDeployImageSet(clusterName, version string, noDigest bool) error {
+	if !strings.HasPrefix(version, "v") {
+		version = "v" + version
+	}
+
+	digestCache := map[string]string{}
+
+	updated := 0
+	err := filepath.WalkDir(clusterName, func(path string, d os.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() {
+			return nil
+		}
+		ext := strings.ToLower(filepath.Ext(path))
+		if ext != ".yaml" && ext != ".yml" {
+			return nil
+		}
+
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return fmt.Errorf("failed to read %s: %w", path, err)
+		}
+
+		original := string(data)
+		result := replaceImageTags(original, version, noDigest, digestCache)
+		if filepath.Base(path) == "kustomization.yaml" {
+			result = refTagRe.ReplaceAllString(result, "${1}"+version)
+		}
+
+		if result == original {
+			return nil
+		}
+
+		if err := os.WriteFile(path, []byte(result), d.Type().Perm()); err != nil {
+			return fmt.Errorf("failed to write %s: %w", path, err)
+		}
+
+		log.Infof("Updated %s", path)
+		updated++
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+
+	log.Infof("image-set complete: %d file(s) updated to %s", updated, version)
+	return nil
+}
+
+// replaceImageTags rewrites all understack image references in content to the
+// given version, optionally pinning the sha256 digest fetched from the registry.
+func replaceImageTags(content, version string, noDigest bool, digestCache map[string]string) string {
+	return imageTagRe.ReplaceAllStringFunc(content, func(match string) string {
+		groups := imageTagRe.FindStringSubmatch(match)
+		imageBase := groups[1]
+		newRef := imageBase + ":" + version
+
+		if noDigest {
+			return newRef
+		}
+
+		if digest, ok := digestCache[newRef]; ok {
+			if digest == "" {
+				return newRef
+			}
+			return newRef + "@" + digest
+		}
+
+		digest, err := resolveDigest(newRef)
+		if err != nil {
+			log.Warnf("Could not resolve digest for %s: %v", newRef, err)
+			digestCache[newRef] = ""
+			return newRef
+		}
+
+		log.Debugf("Resolved %s -> %s", newRef, digest)
+		digestCache[newRef] = digest
+		return newRef + "@" + digest
+	})
+}
+
+// resolveDigest fetches the manifest digest for an image reference from the
+// registry using a lightweight HEAD request (no image data is pulled).
+func resolveDigest(imageRef string) (string, error) {
+	ref, err := name.ParseReference(imageRef)
+	if err != nil {
+		return "", fmt.Errorf("invalid image reference %q: %w", imageRef, err)
+	}
+
+	desc, err := remote.Head(ref, remote.WithAuthFromKeychain(authn.DefaultKeychain))
+	if err != nil {
+		return "", fmt.Errorf("registry lookup failed: %w", err)
+	}
+
+	return desc.Digest.String(), nil
+}

go/understackctl/go.mod

@@ -1,10 +1,11 @@
 module github.com/rackerlabs/understack/go/understackctl
 
-go 1.23.6
+go 1.24.0
 
 require (
 	github.com/Masterminds/sprig/v3 v3.3.0
 	github.com/charmbracelet/log v0.4.2
+	github.com/google/go-containerregistry v0.19.2
 	github.com/gookit/goutil v0.7.3
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
 	github.com/spf13/cobra v1.10.2
@@ -26,46 +27,56 @@ require (
 	github.com/charmbracelet/x/ansi v0.8.0 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
 	github.com/charmbracelet/x/term v0.2.1 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/docker/cli v29.2.1+incompatible // indirect
+	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.9.3 // indirect
 	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/fsnotify/fsnotify v1.8.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/go-logfmt/logfmt v0.6.0 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/compress v1.18.4 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/sagikazarmark/locafero v0.7.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/sourcegraph/conc v0.3.0 // indirect
 	github.com/spf13/afero v1.12.0 // indirect
 	github.com/spf13/cast v1.7.1 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
+	github.com/vbatts/tar-split v0.12.2 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go.uber.org/atomic v1.9.0 // indirect
@@ -74,13 +85,13 @@ require (
 	golang.org/x/crypto v0.32.0 // indirect
 	golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
 	golang.org/x/net v0.33.0 // indirect
-	golang.org/x/oauth2 v0.25.0 // indirect
-	golang.org/x/sync v0.11.0 // indirect
-	golang.org/x/sys v0.30.0 // indirect
+	golang.org/x/oauth2 v0.35.0 // indirect
+	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
 	golang.org/x/term v0.29.0 // indirect
 	golang.org/x/text v0.22.0 // indirect
 	golang.org/x/time v0.8.0 // indirect
-	google.golang.org/protobuf v1.36.1 // indirect
+	google.golang.org/protobuf v1.36.3 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect