docs(adr): add ADR-006 container image pinning policy#775
Merged
Conversation
Closes #740. Sets the three-layer pinning policy that unblocks Phase B of #748 (NVIDIA-owned chart-version pins) and sequences #749 (digest pinning for explicit in-tree overrides) and #745 (admission-time verification for chart-default sub-images). Policy in brief: 1. Pin chart versions for every Helm component, no exceptions. recipes/registry.yaml MUST declare defaultVersion; enforced via \`make bom BOM_STRICT=1\` in qualify. 2. Digest-pin every image AICR overrides explicitly in-tree (the ~25-image surface today). 3. Do NOT pin chart-default sub-images in-tree. Reproducibility for those is delivered by admission-time digest verification (#745), not by per-sub-image override matrices that would block upstream security patches behind AICR releases. Renovate (already in place under #737) is the durable maintenance mechanism: it auto-opens PRs for chart-version bumps and digest rotations under the same tag, so patches still flow as normal CI'd PRs. The ADR also defines the contract new helm components must satisfy: defaultVersion required, digest-pin any image overrides, document regional/account-scoped registry overrides per the aws-efa precedent (PR #774). Per project ADR convention, this document covers the decision and its trade-offs, not implementation progress — adoption sequencing is captured at the end as a forward-looking plan that #748/#749/#745 land incrementally.
Contributor
|
🌿 Preview your docs: https://nvidia-preview-feat-adr-image-pinning-policy.docs.buildwithfern.com/aicr |
This comment was marked as resolved.
This comment was marked as resolved.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
lalitadithya
approved these changes
May 6, 2026
Contributor
Coverage Report ✅
Coverage BadgeNo Go source files changed in this PR. |
23 tasks
njhensley
approved these changes
May 6, 2026
Contributor
|
LGTM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #740. Adds ADR-006 setting the three-layer container image pinning policy for AICR. Mostly writing — no code changes. Unblocks the rest of the #739 supply-chain epic.
Refs #739, #748, #749, #745.
Type of Change
Component(s) Affected
docs/design/006-image-pinning-policy.md)Implementation Notes
Three-layer policy:
make bom BOM_STRICT=1inmake qualify(lands incrementally with Pin chart versions for all components in recipes/registry.yaml #748).Why this shape. The trade-off looks different at each layer:
Renovate is the durable maintenance mechanism — already in place under PR #737. Patches flow as normal CI'd PRs.
Contract for new components. The ADR defines what a new helm component PR must satisfy:
defaultVersionset, digest pin any image overrides, document regional/account-scoped registry overrides per theaws-efaprecedent from PR #774.No
## Statussection — per project ADR convention this document covers the decision and trade-offs, not progress. Adoption sequencing is at the end as a forward-looking plan that #748 / #749 / #745 land incrementally.Testing
ADRs live under
docs/design/and are explicitly excluded from the VitePress sidebar check (tools/check-docs-sidebar), so no sidebar update needed.Risk Assessment
Rollout notes: Future PRs that bump chart versions or add new components are expected to follow the contract in this ADR. Enforcement (CI gates) lands incrementally with #748 and #749.
Checklist
make testwith-race)make lint)docs/design/)git commit -S)