Adding custom test image repo to remove ttl.sh by tommyd450 · Pull Request #301 · securesign/policy-controller-operator

tommyd450 · 2026-08-04T11:06:52Z

Changes to remove ttl.sh dependency from Policy Controller

qodo-for-securesign · 2026-08-04T11:07:52Z

PR Summary by Qodo

Use quay.io/securesign test image repo instead of ttl.sh

✨ Enhancement ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Publish generated E2E test images to quay.io/securesign instead of ttl.sh.
• Switch ClusterImagePolicy matching from repo prefix glob to an exact test image reference.
• Use digest-pinned image references and registry auth for more deterministic test runs.

Diagram

graph TD
  A["E2E test runner"] --> B["test/utils/image.go"] --> C[("quay.io/securesign/e2e-tests")]
  B --> D["Digest ref env var"] --> E["ClusterImagePolicy template"]
  E --> F["K8s admission / policy match"]

High-Level Assessment

The following are alternative approaches to this PR:

1. Run an ephemeral in-cluster registry for E2E

➕ No dependency on external registry availability or credentials
➕ Cleaner isolation per test run / per CI job
➖ More moving parts in the test environment (deployment, routing, cleanup)
➖ May not reflect real-world external registry behavior

2. Use GitHub Container Registry (GHCR) with OIDC/CI identity

➕ Often simpler auth story for GitHub Actions (OIDC/permissions)
➕ High availability and familiar operational model
➖ Ties tests to GitHub-specific infrastructure/permissions
➖ May require org-wide policy changes for package publishing/retention

3. Keep tag-based refs but add explicit cleanup + unique namespaces

➕ Avoids digest-vs-tag mismatches in downstream tooling that expects tags
➕ Still removes ttl.sh dependency while staying human-readable
➖ Mutable tags can introduce flakiness if reused accidentally
➖ Cleanup/retention becomes your responsibility

Recommendation: The PR’s approach (push to a controlled Quay repo and use digest-pinned references) is the most deterministic option and directly addresses ttl.sh dependency/flakiness. Ensure CI has reliable auth to quay.io/securesign and that the quay.expires-after label aligns with Quay’s retention/expiration behavior; otherwise, add a fallback cleanup job or retention policy documentation.

Files changed (2) +26 / -6

Other (2) +26 / -6

common_cluster_image_policy.yaml.tplMatch ClusterImagePolicy against a specific test image reference +1/-1

Match ClusterImagePolicy against a specific test image reference
• Replaces the glob pattern based on 'TEST_IMAGE_PREFIX' with a direct glob of 'TEST_IMAGE'. This narrows policy scope from a repo-prefix wildcard to the specific image reference used by the E2E tests.
test/utils/custom_resources/cluster_image_policies/common_cluster_image_policy.yaml.tpl

image.goPush generated E2E images to Quay and export digest reference +25/-5

Push generated E2E images to Quay and export digest reference

• Generates a random image, adds an expiration label via config mutation, and pushes it to 'quay.io/securesign/e2e-tests' using the default keychain for auth. After pushing, computes the image digest and sets the env var to an immutable 'image@sha256:...' reference, returning that digest ref for downstream use.

test/utils/image.go

qodo-for-securesign · 2026-08-04T11:09:58Z

Code Review by Qodo

🐞 Bugs (3) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Hardcoded Quay repo 🐞 Bug ☼ Reliability

Description

PrepareImage now pushes generated images to the hard-coded repository quay.io/tdalton/e2e-test when
COMMON_TEST_IMAGE/BYOK_TEST_IMAGE/etc are unset, which requires Quay credentials with write access
to that repo and will fail in environments without them. This is a regression from the prior ttl.sh
anonymous push flow and the repo/docs do not set/provision these credentials by default.

Code

test/utils/image.go[R37-40]

+	targetImageName := fmt.Sprintf("quay.io/tdalton/e2e-test:%s", uuid.New().String())
	ref, err := name.ParseReference(targetImageName)
	if err != nil {
		panic(err.Error())

Relevance

●●● Strong
Hardcoded personal Quay repo breaks default e2e runs; prior PrepareImage used anonymous ttl.sh flow.
PR-#36

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
PrepareImage only skips pushing when the caller provides an image via env var; otherwise it builds
an image and pushes it to quay.io/tdalton/e2e-test using the default credential keychain. E2E
tests call this helper in BeforeAll, while the E2E run instructions and Makefile do not set these
image env vars or establish Quay auth, making default runs dependent on external, repo-specific
credentials.
test/utils/image.go[17-55]
test/e2e/policy_controller_e2e_test.go[39-45]
test/e2e_upgrade/upgrade_test.go[65-68]
README.md[96-126]
Makefile[266-277]
test/tas-env-variables.sh[1-68]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`PrepareImage` falls back to pushing a randomly generated image to a hard-coded Quay repository (`quay.io/tdalton/e2e-test`) using `authn.DefaultKeychain`. This introduces an implicit requirement that the caller environment is already authenticated to Quay and has push permission to that specific repository.

## Issue Context
E2E tests call `PrepareImage` unconditionally in `BeforeAll`, and the documented E2E workflow does not instruct users to set image env vars or log in to Quay. As a result, the default E2E path will fail for any developer/CI environment lacking those repo-specific credentials.

## Fix Focus Areas
- test/utils/image.go[17-55]
- README.md[96-126]

## Implementation guidance
- Add a new env var (e.g., `E2E_TEST_IMAGE_REPO` or `TEST_IMAGE_REPO`) that controls the destination repository/prefix, and default it to a neutral/shared location appropriate for CI (or require `imageENV` to be set and return a clear error).
- Keep `PrepareImage` behavior consistent with docs by either:
 - updating README prerequisites to include registry auth + required permissions, and/or
 - making the code fall back to a local/dev-friendly registry option.
- Consider allowing auth to be optionally disabled/overridden (e.g., if pushing to a registry that allows anonymous push).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. Duplicate repo in digestRef 🐞 Bug ⚙ Maintainability ⭐ New

Description

PrepareImage formats digestRef using a second hard-coded repository string instead of deriving it
from targetImageName/ref, creating two sources of truth that can drift and return/set an incorrect
digest reference. This makes future repo changes error-prone and can break e2e image
signing/verification when the strings diverge.

Code

test/utils/image.go[R57-58]

+	digestRef := fmt.Sprintf("quay.io/securesign/e2e-tests@%s", d.String())
+

Relevance

●●● Strong
Single-source-of-truth ref formatting reduces drift risk and matches PR goal of repo change.
PR-#13
PR-#55

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The function builds the push target and digest return value using separate string literals, so
repository updates require editing multiple places and can silently diverge.

test/utils/image.go[37-58]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`PrepareImage` constructs `targetImageName` and successfully parses/pushes it, but then constructs `digestRef` by re-typing the repository string. This creates two independent sources of truth for the repository name.

### Issue Context
Today both strings match, but this pattern is fragile: if `targetImageName` is changed (or made configurable) and `digestRef` is not updated in lockstep, callers will receive a digest reference that does not correspond to the pushed image.

### Fix Focus Areas
- test/utils/image.go[37-58]

### Suggested fix
Build `digestRef` from the parsed/pushed reference (or from a single shared constant), e.g. derive the repository portion from `ref` and then format `repo@sha256:...` rather than embedding `quay.io/securesign/e2e-tests` again.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

3. Stale TEST_IMAGE_PREFIX input 🐞 Bug ⚙ Maintainability ⭐ New

Description

common_cluster_image_policy.yaml.tpl no longer uses TEST_IMAGE_PREFIX, but e2e tests still pass it
when rendering the template, leaving dead configuration that can mislead future edits. Keeping
template inputs aligned with actual template usage improves long-term maintainability.

Code

test/utils/custom_resources/cluster_image_policies/common_cluster_image_policy.yaml.tpl[7]
+    - glob: "{{ .TEST_IMAGE }}"

Relevance

●●● Strong
Removing unused template inputs is a low-risk cleanup; team has accepted similar maintainability
fixes.
PR-#13
PR-#55

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The template now references only .TEST_IMAGE, while multiple tests still pass both TEST_IMAGE
and TEST_IMAGE_PREFIX into RenderTemplate, making TEST_IMAGE_PREFIX unused for this template.
test/utils/custom_resources/cluster_image_policies/common_cluster_image_policy.yaml.tpl[5-8]
test/e2e/policy_controller_e2e_test.go[81-92]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The ClusterImagePolicy template was updated to use only `TEST_IMAGE`, but call sites still provide `TEST_IMAGE_PREFIX` when rendering the template. This is now unused for this template.

### Issue Context
Leaving unused render parameters around makes it harder to reason about what actually affects the rendered YAML and can cause confusion when modifying tests/policies later.

### Fix Focus Areas
- test/utils/custom_resources/cluster_image_policies/common_cluster_image_policy.yaml.tpl[5-8]
- test/e2e/policy_controller_e2e_test.go[81-92]
- test/e2e/update_e2e_test.go[127-137]
- test/e2e_upgrade/upgrade_test.go[197-208]

### Suggested fix
Remove `TEST_IMAGE_PREFIX` from the `RenderTemplate` value maps for this template (or reintroduce its usage in the template if prefix-based matching is still desired).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

Previous review results

Review updated until commit ef35efc

Results up to commit 34d6d64 ⚖️ Balanced

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Hardcoded Quay repo 🐞 Bug ☼ Reliability

Description

PrepareImage now pushes generated images to the hard-coded repository quay.io/tdalton/e2e-test when
COMMON_TEST_IMAGE/BYOK_TEST_IMAGE/etc are unset, which requires Quay credentials with write access
to that repo and will fail in environments without them. This is a regression from the prior ttl.sh
anonymous push flow and the repo/docs do not set/provision these credentials by default.

Code

test/utils/image.go[R37-40]

+	targetImageName := fmt.Sprintf("quay.io/tdalton/e2e-test:%s", uuid.New().String())
	ref, err := name.ParseReference(targetImageName)
	if err != nil {
		panic(err.Error())

Relevance

●●● Strong
Hardcoded personal Quay repo breaks default e2e runs; prior PrepareImage used anonymous ttl.sh flow.
PR-#36

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
PrepareImage only skips pushing when the caller provides an image via env var; otherwise it builds
an image and pushes it to quay.io/tdalton/e2e-test using the default credential keychain. E2E
tests call this helper in BeforeAll, while the E2E run instructions and Makefile do not set these
image env vars or establish Quay auth, making default runs dependent on external, repo-specific
credentials.
test/utils/image.go[17-55]
test/e2e/policy_controller_e2e_test.go[39-45]
test/e2e_upgrade/upgrade_test.go[65-68]
README.md[96-126]
Makefile[266-277]
test/tas-env-variables.sh[1-68]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`PrepareImage` falls back to pushing a randomly generated image to a hard-coded Quay repository (`quay.io/tdalton/e2e-test`) using `authn.DefaultKeychain`. This introduces an implicit requirement that the caller environment is already authenticated to Quay and has push permission to that specific repository.

## Issue Context
E2E tests call `PrepareImage` unconditionally in `BeforeAll`, and the documented E2E workflow does not instruct users to set image env vars or log in to Quay. As a result, the default E2E path will fail for any developer/CI environment lacking those repo-specific credentials.

## Fix Focus Areas
- test/utils/image.go[17-55]
- README.md[96-126]

## Implementation guidance
- Add a new env var (e.g., `E2E_TEST_IMAGE_REPO` or `TEST_IMAGE_REPO`) that controls the destination repository/prefix, and default it to a neutral/shared location appropriate for CI (or require `imageENV` to be set and return a clear error).
- Keep `PrepareImage` behavior consistent with docs by either:
 - updating README prerequisites to include registry auth + required permissions, and/or
 - making the code fall back to a local/dev-friendly registry option.
- Consider allowing auth to be optionally disabled/overridden (e.g., if pushing to a registry that allows anonymous push).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

qodo-for-securesign · 2026-08-04T11:10:02Z

+	targetImageName := fmt.Sprintf("quay.io/tdalton/e2e-test:%s", uuid.New().String())
 	ref, err := name.ParseReference(targetImageName)
 	if err != nil {
 		panic(err.Error())


1. Hardcoded quay repo 🐞 Bug ☼ Reliability

PrepareImage now pushes generated images to the hard-coded repository quay.io/tdalton/e2e-test when COMMON_TEST_IMAGE/BYOK_TEST_IMAGE/etc are unset, which requires Quay credentials with write access to that repo and will fail in environments without them. This is a regression from the prior ttl.sh anonymous push flow and the repo/docs do not set/provision these credentials by default.

Agent Prompt

## Issue description `PrepareImage` falls back to pushing a randomly generated image to a hard-coded Quay repository (`quay.io/tdalton/e2e-test`) using `authn.DefaultKeychain`. This introduces an implicit requirement that the caller environment is already authenticated to Quay and has push permission to that specific repository. ## Issue Context E2E tests call `PrepareImage` unconditionally in `BeforeAll`, and the documented E2E workflow does not instruct users to set image env vars or log in to Quay. As a result, the default E2E path will fail for any developer/CI environment lacking those repo-specific credentials. ## Fix Focus Areas - test/utils/image.go[17-55] - README.md[96-126] ## Implementation guidance - Add a new env var (e.g., `E2E_TEST_IMAGE_REPO` or `TEST_IMAGE_REPO`) that controls the destination repository/prefix, and default it to a neutral/shared location appropriate for CI (or require `imageENV` to be set and return a clear error). - Keep `PrepareImage` behavior consistent with docs by either: - updating README prerequisites to include registry auth + required permissions, and/or - making the code fall back to a local/dev-friendly registry option. - Consider allowing auth to be optionally disabled/overridden (e.g., if pushing to a registry that allows anonymous push).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

tommyd450 · 2026-08-04T14:09:02Z

/retest

tommyd450 · 2026-08-04T14:44:11Z

/retest

tommyd450 · 2026-08-04T14:44:19Z

/tests

tommyd450 · 2026-08-04T15:17:31Z

/retest

tommyd450 · 2026-08-04T15:28:34Z

/retest

tommyd450 · 2026-08-04T15:46:25Z

/retest

tommyd450 · 2026-08-04T19:38:38Z

/retest

qodo-for-securesign · 2026-08-05T07:57:10Z

Code review by qodo was updated up to the latest commit 3b93435

tommyd450 · 2026-08-05T08:05:06Z

/retest

Adding custom test image repo to remove ttl.sh

34d6d64

tommyd450 marked this pull request as draft August 4, 2026 11:07

qodo-for-securesign Bot reviewed Aug 4, 2026

View reviewed changes

Updating to point to securesign repo

18251eb

tommyd450 added 5 commits August 4, 2026 21:39

Updating e2e to be e2e-tests

21ba1b3

Removing Prefix requirement

d1810a0

Adding back vars

40ca3ab

Matching digest for test run

203f52b

Test fix

3b93435

tommyd450 marked this pull request as ready for review August 5, 2026 07:52

petrpinkas approved these changes Aug 5, 2026

View reviewed changes

tommyd450 added 2 commits August 5, 2026 11:56

Ensure same digest is used at all stages

d40e5bf

New Upgrade Image

ef35efc

tommyd450 merged commit eff05be into release-1.0 Aug 5, 2026
6 checks passed

tommyd450 deleted the tdalton/ttl.shRemoval branch August 5, 2026 13:31

Navigation Menu

Uh oh!

Adding custom test image repo to remove ttl.sh - #301

Adding custom test image repo to remove ttl.sh#301
tommyd450 merged 9 commits into
release-1.0from
tdalton/ttl.shRemoval

tommyd450 commented Aug 4, 2026 •

edited

Loading

Uh oh!

qodo-for-securesign Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

qodo-for-securesign Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

qodo-for-securesign Bot Aug 4, 2026

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

qodo-for-securesign Bot commented Aug 5, 2026

Uh oh!

tommyd450 commented Aug 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

tommyd450 commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-for-securesign Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary by Qodo

Uh oh!

qodo-for-securesign Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Previous review results

Uh oh!

qodo-for-securesign Bot Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

qodo-for-securesign Bot commented Aug 5, 2026

Uh oh!

tommyd450 commented Aug 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tommyd450 commented Aug 4, 2026 •

edited

Loading

qodo-for-securesign Bot commented Aug 4, 2026 •

edited

Loading

qodo-for-securesign Bot commented Aug 4, 2026 •

edited

Loading