latest

.vscode/settings.json

@@ -0,0 +1,9 @@
+{
+    "python-envs.pythonProjects": [
+        {
+            "path": ".",
+            "envManager": "ms-python.python:system",
+            "packageManager": "ms-python.python:pip"
+        }
+    ]
+}

README.md

@@ -74,12 +74,15 @@ destination. Rebuild the web image to change it. Keep the DNS A/AAAA addresses,
 and address families your proxy actually uses. The IPv4 proxy listener can still
 serve a dual-stack pod via nginx loopback; egress IPv6 requires cluster support.
 
-Both image variables require a non-`latest` explicit tag or a complete
+Both image variables require an explicit tag (including `latest`) or a complete
-`@sha256:` digest (64 lowercase hex characters). Mutable non-latest tags are
+`@sha256:` digest (64 lowercase hex characters). Tags are mutable; **digests are
-accepted, but **digests are recommended** for reproducibility and supply-chain
+recommended** for reproducibility and supply-chain verification. For `latest`,
-verification. Use admission signature/provenance policies and scan your builds.
+set `luanti_wasm_image_pull_policy: Always` so Kubernetes checks the registry on
-Reusing a mutable tag alone does not trigger a rollout. Image pull credentials
+each container start; the role default is `IfNotPresent`, which can reuse a
-must be pre-created Kubernetes Secrets, referenced by name, never embedded here.
+cached image. Reusing a mutable tag alone does not trigger a rollout. Use
+admission signature/provenance policies and scan your builds. Image pull
+credentials must be pre-created Kubernetes Secrets, referenced by name, never
+embedded here.
 
 ## Deploy
 
@@ -251,7 +254,7 @@ YAML, and checks:
 - default-deny port isolation and exact DNS/game/optional HTTPS destinations;
 - deterministic config checksum and config-triggered rollout changes;
 - actual EOM playbook variables, TLS ingress, optional cert-manager and annotations;
-- rejection of empty/unversioned/latest images, malformed/wildcard CIDRs, bad
+- acceptance of `latest` tags and rejection of empty/unversioned images, malformed/wildcard CIDRs, bad
   names/hostnames, peer shapes, missing TLS, invalid resources/types and timeouts.
 
 [tests/run.sh](tests/run.sh) also syntax-checks the deployment playbook and runs

tasks/validate.yml

@@ -26,15 +26,14 @@
       - luanti_wasm_ingress_annotations is mapping
     fail_msg: Invalid Luanti identity, integer/boolean settings, image pull policy, or tmp size.
 
-- name: Validate explicit versioned Luanti images
+- name: Validate explicit Luanti image references
   ansible.builtin.assert:
     that:
       - item is string
       - item | length > 0
       - item is match('^(?:[a-z0-9]+(?:[.-][a-z0-9]+)*(?::[0-9]+)?/)?[a-z0-9]+(?:[._-][a-z0-9]+)*(?:/[a-z0-9]+(?:[._-][a-z0-9]+)*)*(?::[A-Za-z0-9_][A-Za-z0-9_.-]{0,127})?(?:@sha256:[a-f0-9]{64})?$')
       - item is search(':[A-Za-z0-9_][A-Za-z0-9_.-]*$') or item is search('@sha256:[a-f0-9]{64}$')
-      - item is not search('(?i):latest(?:@|$)')
+    fail_msg: Supply separate web/proxy image references with an explicit tag or sha256 digest.
-    fail_msg: Supply separate web/proxy image references with an explicit non-latest tag or sha256 digest.
   loop: "{{ [luanti_wasm_web_image, luanti_wasm_proxy_image] }}"
 
 - name: Validate Luanti list settings

tests/test.yml

@@ -161,6 +161,21 @@
           - _initial_checksum != _luanti_wasm_manifests.deployment.spec.template.metadata.annotations['checksum/config']
           - "'proxy_read_timeout 7200s;' in _luanti_wasm_manifests.configmap.data['nginx.conf']"
 
+    - name: Accept latest tags for both runtime images
+      ansible.builtin.set_fact:
+        luanti_wasm_web_image: registry.invalid/fixture/luanti-web:latest
+        luanti_wasm_proxy_image: registry.invalid/fixture/lwproxy:latest
+
+    - name: Validate latest-tagged runtime images
+      ansible.builtin.include_role:
+        name: ansible-role-luanti-wasm
+        tasks_from: validate.yml
+
+    - name: Restore pinned test image references
+      ansible.builtin.set_fact:
+        luanti_wasm_web_image: registry.invalid/fixture/luanti-web:test-1
+        luanti_wasm_proxy_image: "registry.invalid/fixture/lwproxy@sha256:{{ 'a' * 64 }}"
+
     - name: Supply fixture eom inputs
       ansible.builtin.set_fact:
         eom_luanti_wasm_web_image: registry.invalid/fixture/eom-web:release-1
@@ -226,8 +241,6 @@
         - {luanti_wasm_web_image: ""}
         - {luanti_wasm_proxy_image: ""}
         - {luanti_wasm_web_image: 'registry.invalid/team/web'}
-        - {luanti_wasm_proxy_image: 'registry.invalid/team/proxy:latest'}
-        - {luanti_wasm_web_image: 'registry.invalid/team/web:LaTeSt'}
         - {luanti_wasm_proxy_image: 'registry.invalid/team/proxy@sha256:abc'}
         - {luanti_wasm_web_image: 'https://registry.invalid/team/web:1'}
         - {luanti_wasm_game_cidrs: []}