Upgrade - argo-rollouts pack to 1.9.1

[Daniel2025-SW]

Upgrade - argo-rollouts pack to 1.9.1

[bulwark-sc-ent]

✅ CVE scan completed successfully.

Scan Summary:

• Total images scanned: 2
• Clean images: 0
• Images with CVEs: 2
• Total CVEs found: 120

🔴 Critical CVEs: 2
🟠 High CVEs: 20
🟡 Medium CVEs: 10
🟢 Low CVEs: 88

Images with CVEs:

• quay.io/argoproj/argo-rollouts:v1.9.1: 60 CVEs (Critical: 1, High: 10, Medium: 5, Low: 44)
  Critical CVEs: CVE-2026-27143
• quay.io/argoproj/kubectl-argo-rollouts:v1.9.1: 60 CVEs (Critical: 1, High: 10, Medium: 5, Low: 44)
  Critical CVEs: CVE-2026-27143

⚠️ Please review the CVE findings above and address critical/high severity issues before merging.

[bulwark-sc-ent]

✅ CVE scan completed successfully.

Scan Summary:

• Total images scanned: 2
• Clean images: 0
• Images with CVEs: 2
• Total CVEs found: 120

🔴 Critical CVEs: 2
🟠 High CVEs: 20
🟡 Medium CVEs: 10
🟢 Low CVEs: 88

Images with CVEs:

• quay.io/argoproj/argo-rollouts:v1.9.1: 60 CVEs (Critical: 1, High: 10, Medium: 5, Low: 44)
  Critical CVEs: CVE-2026-27143
• quay.io/argoproj/kubectl-argo-rollouts:v1.9.1: 60 CVEs (Critical: 1, High: 10, Medium: 5, Low: 44)
  Critical CVEs: CVE-2026-27143

⚠️ Please review the CVE findings above and address critical/high severity issues before merging.

[vishwanaths]

Pack review — argo-rollouts-1.9.1

Packs Validation: passed (run)
source annotation: community
Pack metadata: name=argo-rollouts version=1.9.1 addonType=system app layer=addon displayName=Argo-Rollouts contributor=spectrocloud

Compared against packs/argo-rollouts-1.2.1/

Version bump 1.2.1 → 1.9.1 (minor — skips 1.3.x through 1.8.x, worth confirming this jump is intentional).

Summary of differences

• pack.json:
  • Reformatted (4-space single-line arrays → 2-space multi-line).
  • Removed kubeManifests: ["manifests/install.yaml"].
  • Added charts: ["charts/argo-rollouts-2.41.1.tgz"] — pack switched from a raw-manifest install to a Helm-chart-based install.
  • Added constraints.dependencies entry for kubernetes (minVersion: 1.29, type: optional).
  • No trailing newline at EOF (nit).
• values.yaml: full restructure (4 → 604 lines).
  • Removed: manifests.install.namespace.
  • Added top-level pack.namespace, pack.content.images (quay.io/argoproj/argo-rollouts:v1.9.1, quay.io/argoproj/kubectl-argo-rollouts:v1.9.1), and pack.content.charts (argo-rollouts @ 2.41.1 from https://argoproj.github.io/argo-helm).
  • Added charts.argo-rollouts.* — full upstream chart values (controller, dashboard, CRDs, notifications, PDBs, service, ingress, RBAC, etc.). Defaults look upstream-standard: installCRDs: true, keepCRDs: true, clusterInstall: true, controller image quay.io/argoproj/argo-rollouts:v1.9.1, replicas 2.
• Chart tarball: charts/argo-rollouts-2.41.1.tgz added, 65.24 KiB (66807 B). Previous version had no .tgz (kubeManifests-based). Chart contents not inspected.
• Logo: logo.png unchanged (12979 B, same blob).
• Files added (37): full charts/argo-rollouts/ tree (Chart.yaml, values.yaml, README.md, templates/controller/, templates/dashboard/, templates/crds/{analysis-run,analysis-template,cluster-analysis-template,experiment,rollout}-crd.yaml, templates/aggregate-roles.yaml, templates/extra-manifests.yaml, _helpers.tpl, .helmignore), plus top-level README.md (185 lines).
• Files removed: manifests/install-original.yaml (14,709 lines), manifests/install.yaml (14,718 lines).

pack.json diff

--- a/packs/argo-rollouts-1.2.1/pack.json
+++ b/packs/argo-rollouts-1.9.1/pack.json
@@ -1,19 +1,28 @@
 {
-    "addonType":"system app",
-    "annotations": {
-      "source": "community",
-      "contributor" : "spectrocloud"
-   },
-    "cloudTypes": ["all"],
-    "displayName": "Argo-Rollouts",
-    "kubeManifests": [
-      "manifests/install.yaml"
-    ],
-    "layer": "addon",
-    "name": "argo-rollouts",
-    "version": "1.2.1"
+  "addonType": "system app",
+  "annotations": {
+    "source": "community",
+    "contributor": "spectrocloud"
+  },
+  "charts": [
+    "charts/argo-rollouts-2.41.1.tgz"
+  ],
+  "cloudTypes": [
+    "all"
+  ],
+  "displayName": "Argo-Rollouts",
+  "layer": "addon",
+  "name": "argo-rollouts",
+  "version": "1.9.1",
+  "constraints": {
+    "dependencies": [
+      {
+        "packName": "kubernetes",
+        "layer": "k8s",
+        "minVersion": "1.29",
+        "maxVersion": "",
+        "type": "optional"
+      }
+    ]
   }
-
-
-
-
+}
\ No newline at end of file

values.yaml diff

@@ -1,6 +1,602 @@
-manifests:
-  install:
-    #Namespace to install argo-rollouts
-    namespace: "argo-rollouts"
+pack:
+  namespace: "argo-rollouts"
+  content:
+    images:
+      - image: quay.io/argoproj/argo-rollouts:v1.9.1
+      - image: quay.io/argoproj/kubectl-argo-rollouts:v1.9.1
+
+    charts:
+      - name: argo-rollouts
+        repo: https://argoproj.github.io/argo-helm
+        version: 2.41.1
+
+charts:
+  argo-rollouts:
+    installCRDs: true
+    keepCRDs: true
+    clusterInstall: true
+    createClusterAggregateRoles: true
+    ...
+    controller:
+      image:
+        registry: quay.io
+        repository: argoproj/argo-rollouts
+        tag: v1.9.1
+        pullPolicy: IfNotPresent
+      replicas: 2
+      ...
+    dashboard:
+      ...
+    (600 lines total — diff truncated, see files tab)

Blockers

• None.

Nits / observations

• Version bump 1.2.1 → 1.9.1 is a large minor jump — no intervening minor versions on main. Confirm intentional.
• Install mechanism changed from raw kubeManifests (a 14k-line install.yaml) to a bundled Helm chart. Users upgrading in-place may need migration guidance in release notes / README.
• pack.json has no trailing newline at EOF.
• security-scans/syft-license check is failing on this PR (not Packs Validation, so does not block this review, but the maintainer may want to check it).

Review generated by the pack-reviewer Claude Code subagent.