Files
computer-playbook/docs/contributing/code/role/image.md
T
Environment TestandClaude Sonnet 4.6 aa33256cde feat(mirror): split resolver output, move images to defaults, add lookup plugin
- resolver: output both applications: (config/main.yml compose images) and
  images: (defaults/main.yml images) keyed by source_file
- image_discovery: scan defaults/main.yml instead of vars/main.yml for images:
- mirror_overrides: write mirror URLs to applications.*.compose.services.*
  (mirror_policy-aware) and images_overrides.*.* (always merged, if_missing)
- roles/sys-ctl-hlth-csp, roles/test-e2e-playwright: move images: from
  vars/main.yml to defaults/main.yml for correct Ansible variable precedence
- plugins/lookup/image.py: new Ansible lookup plugin that prefers
  images_overrides over role-local images defaults
- docs: add artefact/image.md and artefact/mirror.md as SPOTs; add
  code/role/image.md contributor guide; link from ci.md
- tests: update test_util, test_mirror_overrides; add test_resolver,
  test_publish (404/401 coverage), test_image (lookup plugin)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-10 11:17:42 +02:00

2.0 KiB

image

This page is the SPOT for role-local non-compose image declarations and runtime access. Use this page for defaults/main.yml, images_overrides, and the lookup('image', ...) contract. For discovery and mirroring, see Role Image Configuration.

Declare

  • Role-local images that are not sourced from applications.*.compose.services.* MUST be declared under defaults/main.yml as images.<service>.{image,version}.
  • Each entry MUST contain both image and version.
  • image MAY use an explicit registry such as mcr.microsoft.com/playwright or an implicit Docker Hub name such as postgres.
  • Role-local image defaults MUST stay in images. Inventory-side overrides MUST NOT be written there.

Example:

# defaults/main.yml
images:
  playwright:
    image: mcr.microsoft.com/playwright
    version: "v1.58.2-noble"

Read

  • Roles MUST use lookup('image', ...) instead of direct images[...] access.
  • The lookup MAY infer the current role id from role_name.
  • If role_name is not available, the role id MUST be passed explicitly.

Supported forms:

{{ lookup('image', 'playwright', 'image') }}
{{ lookup('image', 'test-e2e-playwright', 'playwright', 'image') }}
{{ lookup('image', 'sys-ctl-hlth-csp', 'csp-checker', 'ref') }}

Supported want values:

  • all (default) returns the merged mapping
  • image returns the repository/image name
  • version returns the tag
  • ref returns image:version

Override

  • Inventory-side mirror and manual overrides MUST be written to images_overrides.<role>.<service>.{image,version}.
  • lookup('image', ...) MUST prefer images_overrides and fall back field-wise to role-local images.
  • Inventory generation MUST keep images_overrides separate from images so role defaults remain readable and stable.

Example host-vars override:

images_overrides:
  test-e2e-playwright:
    playwright:
      image: ghcr.io/example/mirror/mcr.microsoft.com/playwright
      version: v1.58.2-noble