[CI] Cloud Installer alpha.197 chart released before required installer image exists

[khalildai]

Failure

Scheduled Cloud Installer And Upgrade Test Ref:v2.3.0-alpha.197 run 30247608677 failed on both Kubernetes matrices before installer execution:

• v1.22 job 89918095768
• v1.33 job 89918095744

Both charts resolved and created the installer Job, but its Pod stayed in ImagePullBackOff because the pinned image did not exist:

Image: docker.io/apecloud/kb-cloud-installer:v2.3.0-alpha.197
failed to resolve reference ... v2.3.0-alpha.197: not found

This is a deterministic release-order / explicit-dependency failure, not a self-hosted runner or Kubernetes-version compatibility failure. Re-running the same workflow before the image exists will reproduce it.

Required contract

• Publish and verify the exact kb-cloud-installer:v2.3.0-alpha.197 image before making the matching chart/version eligible for Cloud Installer CI.
• Add a fail-fast preflight that resolves the exact image manifest before creating either test cluster/installer Job; fail once with the missing immutable dependency instead of waiting for two ImagePullBackOff matrices.
• Preserve the exact chart↔image version contract; do not silently fall back to latest or another alpha.
• Re-run both v1.22 and v1.33 only after the manifest is verifiably available, and retain the image digest in the evidence.

AME did not publish an image, rerun the workflow, or mutate release/workflow/secret configuration.

[khalildai]

2026-07-28 13:49 SGT catch-up patrol broadens the publish-ordering failure beyond the original alpha.197 installer image:

• stable v2.2.82 run 30325033764: both installer-test lanes and the upgrade lane reached Helm deployment, then console remained ErrImagePull / ImagePullBackOff for about 17 minutes with the chart forcing all component tags to v2.2.82.
• alpha.199 run 30329036321: upgrade reached Helm deployment of chart v2.2.83, then docs remained ErrImagePull / ImagePullBackOff for about 14 minutes with the chart forcing all component tags to v2.2.83.

Both are deterministic artifact-availability failures on GitHub-hosted runners, not runner capacity or Kubernetes convergence. The release preflight must resolve every chart-referenced component image by exact tag/digest before starting installer/upgrade tests or publishing the chart. AME did not rerun or mutate a cluster, image, release, registry, secret, or workflow.

[khalildai]

2026-07-31 05:59:03–07:59:19 UTC patrol adds a delayed-image/convergence sample in alpha.204's upgrade lane:

• run 30612359220, exact a5091aefa04683dc84135105c509d2ca24e13ab9
• upgrade job 91097798612
• the v2.2.89 installer Pod remained ErrImagePull/ImagePullBackOff for about 16 minutes, then finally became Running
• because the pull consumed nearly the whole 17-minute readiness budget, the installer was still Running while PostgreSQL initialization was only beginning; the readiness step ended KB Cloud is not ready before the alpha.204 upgrade started
• both clean-install lanes for Kubernetes 1.22 and 1.33 succeeded in the same run

This further supports gating upgrade tests on exact image availability before starting the readiness clock. It is a GitHub-hosted artifact-ordering/convergence failure, not self-hosted runner capacity. Patrol did not rerun or mutate images, release artifacts, registry, cluster, credentials, or workflow.

[khalildai]

2026-07-31 11:59:53–14:00:09 UTC patrol adds alpha.205's upgrade-preflight sample:

• run 30632835334, exact workflow head f1e03027c8c34e30a86c0105157ed20f3f09d83f
• upgrade job 91163120127 installed the v2.2.91 chart, then both console and docs stayed in ErrImagePull / ImagePullBackOff for about 14 minutes
• the installer Pod was still Running after 17 minutes and the readiness budget expired before the alpha.205 upgrade step began
• both clean-install lanes for Kubernetes 1.22 and 1.33 succeeded in the same run

This is another GitHub-hosted artifact-availability/preflight failure, not self-hosted runner capacity. The release gate should resolve every chart-referenced image at the exact tag or digest before starting the readiness clock. Patrol did not rerun or mutate images, release artifacts, registry, cluster, credentials, or workflow.