resolving oci images

[tcurdt]

In our current setup we have a step that resolves

image: ghcr.io/foo/backend:branch

to

image: ghcr.io/foo/backend:commit-SHA

before applying manifests.

Is this also somehow supported with fluxcd?
I found these docs but did not fully understand how to translate that to answer whether that allows such a setup or not.

[kingdonb]

You might want to try combining OCIRepository with imageupdateautomation - https://fluxcd.io/flux/guides/image-update/

With the ImagePolicy, you can select a branch - OCIRepository can itself directly resolve branch refs, but it cannot update the manifest in git to point at the latest version of a branch ref. (Imageupdateautomation cannot do its job without a sortable tag, so the specific tagging strategy you described might work, or not work, depending on your expectations - https://fluxcd.io/flux/guides/sortable-image-tags/)

Does this sound responsive to what you're trying to do? It isn't really clear what you expect from your posted question.

[tcurdt]

The question was whether such a dynamic resolve is possible with flux or not.

"but it cannot update the manifest in git to point at the latest version of a branch ref."

This is not how we handle things currently. We don't update git with the commit sha.
We resolve it during the reconciliation phase (to talk in flux terms).

This https://fluxcd.io/flux/guides/sortable-image-tags/ sounds very close to how we are using it - but I am not totally sure I understand the details correctly yet. This how we tag the images

      - name: build and push
        uses: docker/build-push-action@v6
        with:
          tags: |
            ghcr.io/${{ github.repository_owner }}/backend:commit-${{ github.sha }}
            ghcr.io/${{ github.repository_owner }}/backend:branch-${{ github.ref_name }}
            ${{ github.ref_name == 'main' && format('ghcr.io/{0}/backend:latest', github.repository_owner) || '' }}
          platforms: |
            linux/amd64
          build-args: |
            SHA=${{ github.sha }}
          labels: |
            SHA=${{ github.sha }}
            org.opencontainers.image.revision=${{ github.sha }}
          context: .
          push: ${{ github.event_name == 'push' }}

      - name: image inspect
        run: |
          docker buildx imagetools inspect ghcr.io/${{ github.repository_owner }}/backend:commit-${{ github.sha }}

What we currently do is to look up the the given OCI artifact from the registry.
Let's say image: ghcr.io/foo/backend:branch-main. We then ask the OCI registry for details once.
Since we tag and label the image as shown above we don't run into OCI rate limits.
And we also don't need to do the git dance of pushing the resolved SHA into the repo.

It sounds similar to what the ImagePolicy should be able to do. But it seems to focus on the timestamp (as the SHA is not monotonically increasing).

Do I understand correctly that a timestamp/buildnr is the requirement (to have a strict order) for fluxcd?