From 1cd3dcbe5699129477a5c3aff1f03568ba1c4851 Mon Sep 17 00:00:00 2001 From: Justin Yang Date: Mon, 10 Aug 2026 22:43:36 -0700 Subject: [PATCH 1/4] updated helm chart logic to override the image for codeExecutor if image and backend image names dont match --- .../ci/test-code-executor-image-tag-option.yaml | 15 +++++++++++++++ charts/retool/templates/_helpers.tpl | 6 ++++-- .../templates/deployment_code_executor.yaml | 2 +- charts/retool/values.yaml | 8 ++++++-- values.yaml | 8 ++++++-- 5 files changed, 32 insertions(+), 7 deletions(-) create mode 100644 charts/retool/ci/test-code-executor-image-tag-option.yaml diff --git a/charts/retool/ci/test-code-executor-image-tag-option.yaml b/charts/retool/ci/test-code-executor-image-tag-option.yaml new file mode 100644 index 00000000..ef7df666 --- /dev/null +++ b/charts/retool/ci/test-code-executor-image-tag-option.yaml @@ -0,0 +1,15 @@ +# Exercises the per-workload code executor image overrides +# (deployment_code_executor.yaml + retool.codeExecutor.image.tag). +# Overlaid on top of test-install-values.yaml. +codeExecutor: + image: + # A one-off / support build lives in a different repository than the backend + # and carries a tag the backend image does not have (SHI-448). + repository: tryretool/code-executor-one-offs + # Deliberately differs from the top-level image.tag so the rendered + # deployment proves the per-workload tag override wins over the backend tag. + tag: pr-3.334.6-fcf7211 + # Deliberately differs from the global image.pullPolicy (IfNotPresent in the + # base values) so the rendered deployment proves the per-workload override is + # honored rather than the global value. + pullPolicy: Always diff --git a/charts/retool/templates/_helpers.tpl b/charts/retool/templates/_helpers.tpl index 329fbd90..ef831ed0 100644 --- a/charts/retool/templates/_helpers.tpl +++ b/charts/retool/templates/_helpers.tpl @@ -1195,7 +1195,9 @@ Set code executor image tag Usage: (template "retool.codeExecutor.image.tag" .) */}} {{- define "retool.codeExecutor.image.tag" -}} -{{- if .Values.image.tag -}} +{{- if .Values.codeExecutor.image.tag -}} + {{- .Values.codeExecutor.image.tag -}} +{{- else if .Values.image.tag -}} {{- $valid_retool_version_regexp := "([0-9]+\\.[0-9]+(\\.[0-9]+)?(-[a-zA-Z0-9]+)?)" }} {{- $semver_version_regexp := "[0-9]+\\.[0-9]+(\\.[0-9]+)?" }} {{- $retool_version_with_ce := ( and ( regexMatch $valid_retool_version_regexp $.Values.image.tag ) ( semverCompare ">= 3.20.15-0" ( regexFind $semver_version_regexp $.Values.image.tag ) ) ) }} @@ -1205,7 +1207,7 @@ Usage: (template "retool.codeExecutor.image.tag" .) {{- "1.1.0" -}} {{- end -}} {{- else -}} - {{- fail "Please set a value for .Values.image.tag" }} + {{- fail "Please set a value for .Values.image.tag or .Values.codeExecutor.image.tag" }} {{- end -}} {{- end -}} diff --git a/charts/retool/templates/deployment_code_executor.yaml b/charts/retool/templates/deployment_code_executor.yaml index 76104dbd..aa872953 100644 --- a/charts/retool/templates/deployment_code_executor.yaml +++ b/charts/retool/templates/deployment_code_executor.yaml @@ -125,7 +125,7 @@ spec: containers: - name: code-executor image: "{{ .Values.codeExecutor.image.repository }}:{{ include "retool.codeExecutor.image.tag" . }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} + imagePullPolicy: {{ .Values.codeExecutor.image.pullPolicy | default .Values.image.pullPolicy }} securityContext: {{- if .Values.codeExecutor.securityContext }} {{ toYaml .Values.codeExecutor.securityContext | indent 10 }} diff --git a/charts/retool/values.yaml b/charts/retool/values.yaml index ec110348..3aec8c26 100644 --- a/charts/retool/values.yaml +++ b/charts/retool/values.yaml @@ -781,11 +781,15 @@ mcp: labels: {} codeExecutor: - # as of Chart version 6.7.0, code-executor image version must align with the top-level `image` parameters - # explicitly set other fields as needed + # Code executor normally tracks the top-level `image` parameters. Override the + # tag only when you need a one-off or patched build (e.g. a support build whose + # tag differs from the backend's); running a code executor version that does not + # match the backend is not generally supported. image: repository: tryretool/code-executor-service + # defaults to top level image.tag + tag: null pullPolicy: IfNotPresent replicaCount: 1 diff --git a/values.yaml b/values.yaml index ec110348..3aec8c26 100644 --- a/values.yaml +++ b/values.yaml @@ -781,11 +781,15 @@ mcp: labels: {} codeExecutor: - # as of Chart version 6.7.0, code-executor image version must align with the top-level `image` parameters - # explicitly set other fields as needed + # Code executor normally tracks the top-level `image` parameters. Override the + # tag only when you need a one-off or patched build (e.g. a support build whose + # tag differs from the backend's); running a code executor version that does not + # match the backend is not generally supported. image: repository: tryretool/code-executor-service + # defaults to top level image.tag + tag: null pullPolicy: IfNotPresent replicaCount: 1 From c8a5f9548be9a0d57153237a8fef033ae7c214d9 Mon Sep 17 00:00:00 2001 From: Justin Yang Date: Tue, 11 Aug 2026 18:24:34 -0700 Subject: [PATCH 2/4] Removed superfluous pull policy changes (since not needed) and made the test data better --- ...t-code-executor-image-override-option.yaml | 21 +++++++++++++ .../test-code-executor-image-tag-option.yaml | 31 +++++++++++-------- .../templates/deployment_code_executor.yaml | 2 +- 3 files changed, 40 insertions(+), 14 deletions(-) create mode 100644 charts/retool/ci/test-code-executor-image-override-option.yaml diff --git a/charts/retool/ci/test-code-executor-image-override-option.yaml b/charts/retool/ci/test-code-executor-image-override-option.yaml new file mode 100644 index 00000000..c36a100c --- /dev/null +++ b/charts/retool/ci/test-code-executor-image-override-option.yaml @@ -0,0 +1,21 @@ +# Code executor image WITH an override: both fields must be used verbatim and +# must not inherit from the top-level image.*. Overlaid onto each base +# *values.yaml by .github/kubeconform.sh. +# +# Pairs with test-code-executor-image-tag-option.yaml, which sets the same +# top-level tag but leaves the override unset. Rendering both makes the +# difference explicit. +# +# The repository and tag below are deliberately unlike the top-level image.*, so +# a regression that inherits the backend values, or that falls back to the +# chart's built-in default tag, changes the rendered image and fails the test. +# The tag must stay above the chart's code-executor and workflows version gates +# (>= 3.20.15 and >= 3.6.11), or the deployment is not rendered at all and the +# test silently asserts nothing. +image: + tag: 9.9.9-test + +codeExecutor: + image: + repository: example/code-executor-service + tag: 8.8.8-test-override diff --git a/charts/retool/ci/test-code-executor-image-tag-option.yaml b/charts/retool/ci/test-code-executor-image-tag-option.yaml index ef7df666..76d63a3f 100644 --- a/charts/retool/ci/test-code-executor-image-tag-option.yaml +++ b/charts/retool/ci/test-code-executor-image-tag-option.yaml @@ -1,15 +1,20 @@ -# Exercises the per-workload code executor image overrides -# (deployment_code_executor.yaml + retool.codeExecutor.image.tag). -# Overlaid on top of test-install-values.yaml. +# Code executor image, NO override: the tag must be inherited from the +# top-level image.tag. Overlaid onto each base *values.yaml by +# .github/kubeconform.sh. +# +# Pairs with test-code-executor-image-override-option.yaml, which sets the same +# top-level tag but does override. Rendering both makes the difference explicit. +# +# codeExecutor.image.tag is set to null on purpose rather than omitted: null is +# the chart default and must behave the same as absent, so an operator who +# leaves the key in place (or copies it from values.yaml) still inherits instead +# of rendering an empty tag. +# The tag must stay above the chart's code-executor and workflows version gates +# (>= 3.20.15 and >= 3.6.11), or the deployment is not rendered at all and the +# test silently asserts nothing. +image: + tag: 9.9.9-test + codeExecutor: image: - # A one-off / support build lives in a different repository than the backend - # and carries a tag the backend image does not have (SHI-448). - repository: tryretool/code-executor-one-offs - # Deliberately differs from the top-level image.tag so the rendered - # deployment proves the per-workload tag override wins over the backend tag. - tag: pr-3.334.6-fcf7211 - # Deliberately differs from the global image.pullPolicy (IfNotPresent in the - # base values) so the rendered deployment proves the per-workload override is - # honored rather than the global value. - pullPolicy: Always + tag: null diff --git a/charts/retool/templates/deployment_code_executor.yaml b/charts/retool/templates/deployment_code_executor.yaml index aa872953..76104dbd 100644 --- a/charts/retool/templates/deployment_code_executor.yaml +++ b/charts/retool/templates/deployment_code_executor.yaml @@ -125,7 +125,7 @@ spec: containers: - name: code-executor image: "{{ .Values.codeExecutor.image.repository }}:{{ include "retool.codeExecutor.image.tag" . }}" - imagePullPolicy: {{ .Values.codeExecutor.image.pullPolicy | default .Values.image.pullPolicy }} + imagePullPolicy: {{ .Values.image.pullPolicy }} securityContext: {{- if .Values.codeExecutor.securityContext }} {{ toYaml .Values.codeExecutor.securityContext | indent 10 }} From 16e5713325b845063cf3058b60c3c77356fd073f Mon Sep 17 00:00:00 2001 From: Justin Yang Date: Fri, 14 Aug 2026 21:20:38 -0700 Subject: [PATCH 3/4] Addrssed PR comments --- ...t-code-executor-image-override-option.yaml | 4 ---- .../test-code-executor-image-tag-option.yaml | 20 ------------------- 2 files changed, 24 deletions(-) delete mode 100644 charts/retool/ci/test-code-executor-image-tag-option.yaml diff --git a/charts/retool/ci/test-code-executor-image-override-option.yaml b/charts/retool/ci/test-code-executor-image-override-option.yaml index c36a100c..95d74f77 100644 --- a/charts/retool/ci/test-code-executor-image-override-option.yaml +++ b/charts/retool/ci/test-code-executor-image-override-option.yaml @@ -2,10 +2,6 @@ # must not inherit from the top-level image.*. Overlaid onto each base # *values.yaml by .github/kubeconform.sh. # -# Pairs with test-code-executor-image-tag-option.yaml, which sets the same -# top-level tag but leaves the override unset. Rendering both makes the -# difference explicit. -# # The repository and tag below are deliberately unlike the top-level image.*, so # a regression that inherits the backend values, or that falls back to the # chart's built-in default tag, changes the rendered image and fails the test. diff --git a/charts/retool/ci/test-code-executor-image-tag-option.yaml b/charts/retool/ci/test-code-executor-image-tag-option.yaml deleted file mode 100644 index 76d63a3f..00000000 --- a/charts/retool/ci/test-code-executor-image-tag-option.yaml +++ /dev/null @@ -1,20 +0,0 @@ -# Code executor image, NO override: the tag must be inherited from the -# top-level image.tag. Overlaid onto each base *values.yaml by -# .github/kubeconform.sh. -# -# Pairs with test-code-executor-image-override-option.yaml, which sets the same -# top-level tag but does override. Rendering both makes the difference explicit. -# -# codeExecutor.image.tag is set to null on purpose rather than omitted: null is -# the chart default and must behave the same as absent, so an operator who -# leaves the key in place (or copies it from values.yaml) still inherits instead -# of rendering an empty tag. -# The tag must stay above the chart's code-executor and workflows version gates -# (>= 3.20.15 and >= 3.6.11), or the deployment is not rendered at all and the -# test silently asserts nothing. -image: - tag: 9.9.9-test - -codeExecutor: - image: - tag: null From e88c8572fe6aaf1c3ecf5711137131ae0cc507c5 Mon Sep 17 00:00:00 2001 From: Justin Yang Date: Mon, 17 Aug 2026 20:08:45 -0700 Subject: [PATCH 4/4] Removed pullpolicy --- charts/retool/Chart.yaml | 2 +- charts/retool/values.yaml | 2 +- values.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/retool/Chart.yaml b/charts/retool/Chart.yaml index 79a41372..0b5c82da 100644 --- a/charts/retool/Chart.yaml +++ b/charts/retool/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: retool description: A Helm chart for Kubernetes type: application -version: 6.11.19 +version: 6.11.20 maintainers: - name: Retool Engineering email: engineering+helm@retool.com diff --git a/charts/retool/values.yaml b/charts/retool/values.yaml index 3aec8c26..46aa9b14 100644 --- a/charts/retool/values.yaml +++ b/charts/retool/values.yaml @@ -790,7 +790,7 @@ codeExecutor: repository: tryretool/code-executor-service # defaults to top level image.tag tag: null - pullPolicy: IfNotPresent + # pull policy will use the value set in the top-level image.pullPolicy replicaCount: 1 diff --git a/values.yaml b/values.yaml index 3aec8c26..46aa9b14 100644 --- a/values.yaml +++ b/values.yaml @@ -790,7 +790,7 @@ codeExecutor: repository: tryretool/code-executor-service # defaults to top level image.tag tag: null - pullPolicy: IfNotPresent + # pull policy will use the value set in the top-level image.pullPolicy replicaCount: 1