From 2a10b14d9e5ce0fa21dd6e73ca899b601ec1c0db Mon Sep 17 00:00:00 2001
From: pnoker <pnokers@gmail.com>
Date: Wed, 19 Aug 2026 14:49:26 +0800
Subject: [PATCH] fix(deploy): pin web image tag correctly in k8s and helm

---
 dc3/deploy/helm/dc3/README.md                     | 2 +-
 dc3/deploy/helm/dc3/templates/app-deployment.yaml | 2 +-
 dc3/deploy/helm/dc3/values.yaml                   | 4 ++++
 dc3/deploy/k8s/kustomization.yaml                 | 5 ++++-
 dc3/deploy/k8s/web/deployment.yaml                | 3 ++-
 5 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/dc3/deploy/helm/dc3/README.md b/dc3/deploy/helm/dc3/README.md
index 212d7938d..41dac2b2b 100644
--- a/dc3/deploy/helm/dc3/README.md
+++ b/dc3/deploy/helm/dc3/README.md
@@ -40,7 +40,7 @@ helm upgrade --install dc3 . -f values-production.yaml   --set image.registry=my
 
 | Value | Default | Meaning |
 |-------|---------|---------|
-| `image.registry` / `image.tag` | `pnoker` / `2026.6` | image source for every component |
+| `image.registry` / `image.tag` | `pnoker` / `2026.6` | image source for every component (`services.web.tag` overrides: web has no series tag) |
 | `secrets.*` | weak public defaults | **replace before production** |
 | `existingSecret` | `""` | use your own Secret instead of the chart-owned one |
 | `services.<name>.replicas` | per service | replica count per stateless service |
diff --git a/dc3/deploy/helm/dc3/templates/app-deployment.yaml b/dc3/deploy/helm/dc3/templates/app-deployment.yaml
index 5f18bb0c8..914235c4a 100644
--- a/dc3/deploy/helm/dc3/templates/app-deployment.yaml
+++ b/dc3/deploy/helm/dc3/templates/app-deployment.yaml
@@ -32,7 +32,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: dc3-{{ $name }}
-          image: "{{ $.Values.image.registry }}/{{ $svc.image }}:{{ $.Values.image.tag }}"
+          image: "{{ $.Values.image.registry }}/{{ $svc.image }}:{{ $svc.tag | default $.Values.image.tag }}"
           imagePullPolicy: {{ $.Values.image.pullPolicy }}
 {{- if $svc.envFrom }}
           envFrom:
diff --git a/dc3/deploy/helm/dc3/values.yaml b/dc3/deploy/helm/dc3/values.yaml
index 21b427f50..e99858c6a 100644
--- a/dc3/deploy/helm/dc3/values.yaml
+++ b/dc3/deploy/helm/dc3/values.yaml
@@ -102,6 +102,10 @@ services:
   web:
     enabled: true
     image: dc3-web
+    # dc3-web is published only as `latest` and full release versions (e.g.
+    # 2026.6.0) - it has NO series tag, so it overrides the global image.tag.
+    # Pin a full release version for reproducible production rollouts.
+    tag: latest
     replicas: 1
     envFrom: false
     httpPort: 80
diff --git a/dc3/deploy/k8s/kustomization.yaml b/dc3/deploy/k8s/kustomization.yaml
index 0fcd0704f..41b0ea8ad 100644
--- a/dc3/deploy/k8s/kustomization.yaml
+++ b/dc3/deploy/k8s/kustomization.yaml
@@ -74,8 +74,11 @@ secretGenerator:
 
 # Single place to bump/switch the image tag or registry for every component.
 images:
+  # dc3-web is published only as `latest` and full release versions (e.g.
+  # 2026.6.0) - it has NO series tag. Pin a full release version here for
+  # reproducible production rollouts.
   - name: pnoker/dc3-web
-    newTag: 2026.6
+    newTag: latest
   - name: pnoker/dc3-gateway
     newTag: 2026.6
   - name: pnoker/dc3-center-auth
diff --git a/dc3/deploy/k8s/web/deployment.yaml b/dc3/deploy/k8s/web/deployment.yaml
index 242af22fe..0b6a9aac3 100644
--- a/dc3/deploy/k8s/web/deployment.yaml
+++ b/dc3/deploy/k8s/web/deployment.yaml
@@ -24,7 +24,8 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: dc3-web
-          image: pnoker/dc3-web:2026.6
+          # dc3-web has no series tag - latest or a full release version only
+          image: pnoker/dc3-web:latest
           imagePullPolicy: IfNotPresent
           env:
             - name: APP_API_HOST