Release practice
We (Observability) create a tag for every charm release, for example:
Notice how the upstream-source, which is taken from charmcraft.yaml, is a major version tag. So, by looking at the github tag description above, or the output of charmcraft resource-revisions below,
$ charmcraft resource-revisions grafana-k8s grafana-image
Revision Created at Size Architectures
71 2025-02-07T06:45:22Z 505B amd64
70 2024-08-12T15:34:14Z 505B amd64
69 2024-06-18T22:55:38Z 505B all
68 2024-03-14T14:54:20Z 505B all
we cannot immediately tell the workload version a given charm revision is associated with!
Obtain the workload version
To obtain the workload version, if we assume the OCI image has a org.opencontainers.image.version label (always true for rocks), then all we need to do is:
- Obtain charm id.
- Download the oci image resource blob and extract image id, username and password.
skopeo inspectthe image to extract the image version.
In a script it may look like this:
#!/bin/bash
charm_name="grafana-k8s"
resource_rev="71"
# The following vars must have a match on charmhub for the
# API request to go through, but they don't matter themselves
# because all we need is the charm id.
channel="1/stable"
arch="amd64"
channel="20.04"
# OBTAIN CHARM ID
# The "action" part is a required stand-in. Didn't know how to render it better.
charm_id=$(curl -sfL -XPOST --header "Content-Type: application/json" -d "{
\"context\": [],
\"actions\": [
{
\"action\": \"install\",
\"instance-key\": \"this-is-a-test-for-resources-lookup-2025-06-11\",
\"name\": \"$charm_name\",
\"channel\": \"$channel\",
\"base\": {
\"architecture\": \"$arch\",
\"name\": \"ubuntu\",
\"channel\": \"$channel\"
}
}
],
\"fields\": [\"id\"]
}" https://api.charmhub.io/v2/charms/refresh | jq -r '.results[0].id')
# PROCESS OCI IMAGE RESOURCE BLOB
oci_image_resource_blob=$(curl -sfL "https://api.charmhub.io/api/v1/resources/download/charm_${charm_id}.grafana-image_${resource_rev}")
image_id=$(echo $oci_image_resource_blob | jq -r '.ImageName')
username=$(echo $oci_image_resource_blob | jq -r '.Username')
password=$(echo $oci_image_resource_blob | jq -r '.Password')
# EXTRACT WORKLOAD VERSION
skopeo inspect --creds "${username}:${password}" "docker://${image_id}" | jq -r '.Labels."org.opencontainers.image.version"'
Use cases
- The image we test in the release CI is not necessarily the same image the charm is released with, because the major version tag may have been updated in between. This way we will at least have a true record on the tag description.
- When oci-factory / ROCKsBot reports vulnerabilities in upstream applications, this is a quick way to determine which resource revisions, and hence charm revisions, are affected.
Thanks to @lengau @verterok @taurus for the guidance!
here it is: