pkg/client: Add sha field to PrometheusSpec

Documentation/api.md

@@ -259,6 +259,7 @@ PrometheusSpec is a specification of the desired behavior of the Prometheus clus
 | serviceMonitorNamespaceSelector | Namespaces to be selected for ServiceMonitor discovery. If nil, only check own namespace. | *[metav1.LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#labelselector-v1-meta) | false |
 | version | Version of Prometheus to be deployed. | string | false |
 | tag | Tag of Prometheus container image to be deployed. Defaults to the value of `version`. | string | false |
+| sha | Sha of Prometheus container image to be deployed. Defaults to the value of `version`. Similar to a tag, but the sha explicitly deploys an immutable container image. | string | false |
 | paused | When a Prometheus deployment is paused, no actions except for deletion will be performed on the underlying objects. | bool | false |
 | baseImage | Base image to use for a Prometheus deployment. | string | false |
 | imagePullSecrets | An optional list of references to secrets in the same namespace to use for pulling prometheus and alertmanager images from registries see http://kubernetes.io/docs/user-guide/images#specifying-imagepullsecrets-on-a-pod | [][v1.LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#localobjectreference-v1-core) | false |

example/prometheus-operator-crd/prometheus.crd.yaml

@@ -2376,6 +2376,11 @@ spec:
                     "In", and the values array contains only "value". The requirements
                     are ANDed.
                   type: object
+            sha:
+              description: Sha of Prometheus container image to be deployed. Defaults
+                to the value of `version`. Similar to a tag, but the sha explicitly
+                deploys an immutable container image.
+              type: string
             storage:
               description: StorageSpec defines the configured storage for a group
                 Prometheus servers. If neither `emptyDir` nor `volumeClaimTemplate`

pkg/client/monitoring/v1/openapi_generated.go

@@ -1181,6 +1181,13 @@ func schema_pkg_client_monitoring_v1_PrometheusSpec(ref common.ReferenceCallback
 							Format:      "",
 						},
 					},
+					"sha": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Sha of Prometheus container image to be deployed. Defaults to the value of `version`. Similar to a tag, but the sha explicitly deploys an immutable container image.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
 					"paused": {
 						SchemaProps: spec.SchemaProps{
 							Description: "When a Prometheus deployment is paused, no actions except for deletion will be performed on the underlying objects.",

pkg/client/monitoring/v1/types.go

@@ -67,6 +67,9 @@ type PrometheusSpec struct {
 	Version string `json:"version,omitempty"`
 	// Tag of Prometheus container image to be deployed. Defaults to the value of `version`.
 	Tag string `json:"tag,omitempty"`
+	// Sha of Prometheus container image to be deployed. Defaults to the value of `version`.
+	// Similar to a tag, but the sha explicitly deploys an immutable container image.
+	Sha string `json:"sha,omitempty"`
 	// When a Prometheus deployment is paused, no actions except for deletion
 	// will be performed on the underlying objects.
 	Paused bool `json:"paused,omitempty"`

pkg/prometheus/statefulset.go

@@ -714,10 +714,17 @@ func makeStatefulSetSpec(p monitoringv1.Prometheus, c *Config, ruleConfigMapName
 		promArgs = append(promArgs, "--storage.tsdb.min-block-duration=2h", "--storage.tsdb.max-block-duration=2h")
 	}
 
+	// Version is used by default.
+	// If the tag is specified, we use the tag to identify the container image.
+	// If the sha is specified, we use the sha to identify the container image,
+	// as it has even stronger immutable guarantees to identify the image.
 	prometheusTag := p.Spec.Version
 	if p.Spec.Tag != "" {
 		prometheusTag = p.Spec.Tag
 	}
+	if p.Spec.Sha != "" {
+		prometheusTag = p.Spec.Sha
+	}
 
 	return &appsv1.StatefulSetSpec{
 		ServiceName:         governingServiceName,

pkg/prometheus/statefulset_test.go

@@ -361,7 +361,7 @@ func TestListenLocal(t *testing.T) {
 	}
 }
 
-func TestTagAndVersion(t *testing.T) {
+func TestTagAndShaAndVersion(t *testing.T) {
 	sset, err := makeStatefulSet(monitoringv1.Prometheus{
 		Spec: monitoringv1.PrometheusSpec{
 			Tag:     "my-unrelated-tag",
@@ -377,6 +377,23 @@ func TestTagAndVersion(t *testing.T) {
 	if image != expected {
 		t.Fatalf("Unexpected container image.\n\nExpected: %s\n\nGot: %s", expected, image)
 	}
+
+	sset, err = makeStatefulSet(monitoringv1.Prometheus{
+		Spec: monitoringv1.PrometheusSpec{
+			Sha:     "1809f7cd0c75acf34f56d8c19782b99c6b5fcd14128a3cc79aca38a4f94af3ff",
+			Tag:     "my-unrelated-tag",
+			Version: "v2.3.2",
+		},
+	}, appsv1.OrderedReadyPodManagement, defaultTestConfig, nil, "")
+	if err != nil {
+		t.Fatalf("Unexpected error while making StatefulSet: %v", err)
+	}
+
+	image = sset.Spec.Template.Spec.Containers[0].Image
+	expected = "quay.io/prometheus/prometheus:1809f7cd0c75acf34f56d8c19782b99c6b5fcd14128a3cc79aca38a4f94af3ff"
+	if image != expected {
+		t.Fatalf("Unexpected container image.\n\nExpected: %s\n\nGot: %s", expected, image)
+	}
 }
 
 func TestThanosTagAndVersion(t *testing.T) {