[Q] build tag vs. deployment tag

[CrystalMethod]

Even after reading #3269, I am having trouble understanding the relationship between build tag and deployment tag. Maybe my problem has nothing to do with #3269.

I would like to describe my problem: I have a project where an image is to be built using Maven/Jib and deployed to a local minikube (Docker backend). The Helm Chart is referenced remotely. This Helm Chart adds labels to almost all Kubernetes objects. One of the labels is

app.kubernetes.io/version: {{ .Values.image.tag | quote }}

Expected behavior

skaffold deploy should use the tag produced by the given build.tagPolicy

Actual behavior

$ skaffold dev -p local
Listing files to watch...
 - <image>
Generating tags...
 - <image> -> <image>:2021-11-04_23-54-14.141_CET
Checking cache...
 - <image>: Found. Tagging
Tags used in deployment:
 - <image> -> <image>:4a9062ee615b7604427b2c6035e07d6e66b941406142bdc2d0a996a6276e7f1e
Starting deploy...
Helm release <release> not installed. Installing...
Error: INSTALLATION FAILED: ServiceAccount "<name>" is invalid: metadata.labels: Invalid value: "4a9062ee615b7604427b2c6035e07d6e66b941406142bdc2d0a996a6276e7f1e": must be no more than 63 characters
Cleaning up...
release "<release>" uninstalled

Information

• Skaffold version: v1.34.0
• Operating system: ArchLinux/WSL2
• Installed via: skaffold.dev
• Contents of skaffold.yaml:

apiVersion: skaffold/v2beta25
kind: Config
metadata:
  name: <..>

build:
  tagPolicy:
    dateTime: {}
  artifacts:
  - image: <..>
    context: .
    jib: {}

deploy:
  helm:
    releases:
      - name: <..>
        remoteChart: <..>
        artifactOverrides:
          image: <..>
        imageStrategy:
          helm: {}

profiles:
  - name: local
    build:
      local:
        push: false
    activation:
      - kubeContext: minikube

• I know that I could truncate the labels in the Helm template. But these Helm charts are maintained by another party.
• Several tests to do this with setValues / setValueTemplates also failed.

[briandealwis]

You're hitting a limitation of building with the local docker daemon which is documented in the Tagging section of the docs.

Skaffold generates a tag to name the image when pushing the built image (2021-11-04_23-54-14.141_CET in your example above). Once the image is pushed to a remote registry, the registry returns the digest of the image: this digest uniquely identifies that image. When deploying the images, Skaffold rewrites each reference to built images to use both the generated tag and the resulting image digest. Container runtimes ignore the tag when a digest is specified, and the tag is really only useful for human consumption. Using the digest also avoids avoids any confusion with Kuberrnetes's caching semantics (see imagePullPolicy for details).

But the docker daemon does not use image digests. So Skaffold instead generates a separate tag computed based on the artifact contents to provide similar semantics to specifying a digest.

I think you can use the trunc function to trim the tag to the desired length. Something like the following?

app.kubernetes.io/version: {{ .Values.image.tag | trunc 63 | quote }}

[CrystalMethod]

_labels.tpl:

{{- $tag := ( .Values.image.tag | default .Chart.AppVersion) -}}
{{- $strippedTag := (regexReplaceAll "@.+:.+$" $tag "") -}}
app.kubernetes.io/version: {{ $strippedTag | trunc 63 | quote }}

With something like this we are now able to strip off the image digest when setting the app.kubernetes.io/version label.