Skip to main content
By default, Deployment creation references an Astro Runtime image by its tag in the Kubernetes spec, like quay.io/astronomer/astro-runtime:9.3.0. However, image tags are mutable and can lead to non-reproducible builds if the image associated with the tag changes. Instead of using the Runtime image tag, you can configure Astro Private Cloud to reference a Runtime image’s immutable sha256 digest, such as quay.io/astronomer/astro-runtime@sha256:<digest>. Using the sha256 digest ensures secure, immutable, and reproducible Deployments, which prevents unexpected behavior caused by tag reassignments. After you enable using the sha256 digest, when users create or update Deployments that include a SHA version, they still see the same Runtime Image tag view as before in the UI or CLI, but the system resolves the build using the sha256 digest in the Kubernetes spec.

​
Step 1: Enable configuration

Apply a config change to your APC API values.yaml file to enable custom image SHA support.
The legacy key deployments.customImageShaEnabled: true is still accepted and is automatically migrated to deployments.runtimeManagement.customImageSha.enabled, but new configurations should use deployments.runtimeManagement.customImageSha.enabled.

​
Step 2: (Optional) Correlate SHA256 with Runtime versions

By default, Astro Private Cloud checks for Airflow updates, which are included in the Astro Runtime, once per day at midnight by querying https://updates.astronomer.io/astronomer-runtime. This returns a JSON file with details about the latest available Astro Runtime versions. You can store this information in the cluster itself by completing the following steps:
  1. Download the JSON files and store them in a Kubernetes configmap by running the following commands:
  1. Open the astro_runtime_release.json file and manually add the SHA256 values that you want Deployments to use for each Runtime version. For example, the following code example shows
Add the Tag and SHA256 value and save:
  1. Add your configmap name, astro-runtime-base-images to your APC API configuration using the runtimeReleasesConfigMapName configuration:

​
Step 3: (Optional) Override the Runtime repository

Astro Private Cloud defaults to the public Astro Runtime repositories (quay.io/astronomer/astro-runtime for Airflow 2.x and astrocrpublic.azurecr.io/runtime for Airflow 3.x). If you need to pull Runtime images from a mirror or private registry, keep the customImageSha setting from Step 1 and override the repository under helm.runtimeImages (Airflow 2.x) and/or helm.runtimeImagesV3 (Airflow 3.x):
Configure the repository without a @sha256 suffix. When custom image SHA is enabled, Astro Private Cloud appends @sha256 to the repository and sets the image tag to the bare digest, for example quay.io/astronomer/astro-runtime@sha256:<digest>. If your repository already ends in @sha256, Astro Private Cloud doesn’t append a second one.