Parent: #739
Related: #742 (per-component pinning policy)
Summary
Close the remaining gaps in the chart "Pinned Version" column. Today 6 helm components in recipes/registry.yaml lack a defaultVersion, so renders track upstream-latest non-deterministically.
Components without a pinned chart version
gpu-operator — nvidia/gpu-operatornetwork-operator — nvidia/network-operatornvidia-dra-driver-gpu — nvidia/nvidia-dra-driver-gpunodewright-operator — skyhook-operatornfd — node-feature-discoveryk8s-ephemeral-storage-metrics — k8s-ephemeral-storage-metrics
(Manifest-only components gke-nccl-tcpxo and nodewright-customizations have no chart and are out of scope here.)
Why now
Reproducibility: same recipe rendered today vs. next month should produce the same Helm template output and the same image set. Today's BOM is a snapshot, not a contract.
Why some are likely unpinned today
NVIDIA-owned charts (gpu-operator, network-operator, dra-driver, nodewright) probably stayed unpinned so security patches flow without forcing an AICR release. Pinning trades that ergonomic win for reproducibility. The trade-off is the policy debate filed in #742, and that decision feeds into this work for the NVIDIA-owned subset.
Proposed approach
For each component:
- Pick a version (current stable upstream, or whatever the team has been deploying in production).
- Add
defaultVersion: "<ver>" to the registry entry.
- Re-render with
make bom to confirm the chart still parses our values.yaml at that version (chart upgrades occasionally restructure values).
- Run e2e/health checks for the component.
- Wire a Renovate (or Dependabot) rule that auto-opens PRs when a newer chart version is published.
Success criteria
- Every helm component in
recipes/registry.yaml has a non-empty defaultVersion.
make bom BOM_STRICT=1 passes (already enforces "no unpinned chart versions").BOM_STRICT=1 is wired into make qualify (or a dedicated CI job) so future component additions can't regress.- Renovate config opens PRs on chart-version bumps.
Out of scope
- Digest-pinning images deployed by these charts — covered in the Tier 2 issue.
- Forking charts. We pin upstream versions only.
Sequencing
External charts (nfd, k8s-ephemeral-storage-metrics) can be pinned immediately; they have no policy ambiguity. NVIDIA-owned charts wait on the #742 policy outcome before pinning, but the registry/CI work can proceed in parallel.
Parent: #739
Related: #742 (per-component pinning policy)
Summary
Close the remaining gaps in the chart "Pinned Version" column. Today 6 helm components in
recipes/registry.yamllack adefaultVersion, so renders track upstream-latest non-deterministically.Components without a pinned chart version
gpu-operator—nvidia/gpu-operatornetwork-operator—nvidia/network-operatornvidia-dra-driver-gpu—nvidia/nvidia-dra-driver-gpunodewright-operator—skyhook-operatornfd—node-feature-discoveryk8s-ephemeral-storage-metrics—k8s-ephemeral-storage-metrics(Manifest-only components
gke-nccl-tcpxoandnodewright-customizationshave no chart and are out of scope here.)Why now
Reproducibility: same recipe rendered today vs. next month should produce the same Helm template output and the same image set. Today's BOM is a snapshot, not a contract.
Why some are likely unpinned today
NVIDIA-owned charts (gpu-operator, network-operator, dra-driver, nodewright) probably stayed unpinned so security patches flow without forcing an AICR release. Pinning trades that ergonomic win for reproducibility. The trade-off is the policy debate filed in #742, and that decision feeds into this work for the NVIDIA-owned subset.
Proposed approach
For each component:
defaultVersion: "<ver>"to the registry entry.make bomto confirm the chart still parses ourvalues.yamlat that version (chart upgrades occasionally restructure values).Success criteria
recipes/registry.yamlhas a non-emptydefaultVersion.make bom BOM_STRICT=1passes (already enforces "no unpinned chart versions").BOM_STRICT=1is wired intomake qualify(or a dedicated CI job) so future component additions can't regress.Out of scope
Sequencing
External charts (
nfd,k8s-ephemeral-storage-metrics) can be pinned immediately; they have no policy ambiguity. NVIDIA-owned charts wait on the #742 policy outcome before pinning, but the registry/CI work can proceed in parallel.