fix(kustomize): match image names using SplitImageName to support registry ports and digests (#29970)

cmd/argocd/commands/app_test.go

@@ -1116,6 +1116,15 @@ func Test_unset(t *testing.T) {
 	assert.False(t, updated)
 	assert.False(t, nothingToUnset)
 
+	kustomizeSource.Kustomize.Images = v1alpha1.KustomizeImages{
+		"registry.example.com:5000/team/foo:1.0",
+		"registry.example.com:5000/team/bar:1.0",
+	}
+	updated, nothingToUnset = unset(kustomizeSource, unsetOpts{kustomizeImages: []string{"registry.example.com:5000/team/bar"}})
+	assert.True(t, updated)
+	assert.False(t, nothingToUnset)
+	assert.Equal(t, v1alpha1.KustomizeImages{"registry.example.com:5000/team/foo:1.0"}, kustomizeSource.Kustomize.Images)
+
 	assert.Len(t, kustomizeSource.Kustomize.Replicas, 2)
 	updated, nothingToUnset = unset(kustomizeSource, unsetOpts{kustomizeReplicas: []string{"my-deployment"}})
 	assert.Len(t, kustomizeSource.Kustomize.Replicas, 1)

go.mod

@@ -133,6 +133,7 @@ require (
 	layeh.com/gopher-json v0.0.0-20190114024228-97fed8db8427
 	oras.land/oras-go/v2 v2.6.2
 	sigs.k8s.io/controller-runtime v0.25.2
+	sigs.k8s.io/kustomize/api v0.21.1
 	sigs.k8s.io/structured-merge-diff/v6 v6.4.2
 	sigs.k8s.io/yaml v1.6.0
 )
@@ -318,7 +319,6 @@ require (
 	k8s.io/kubernetes v1.37.0 // indirect
 	nhooyr.io/websocket v1.8.7 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
-	sigs.k8s.io/kustomize/api v0.21.1 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.21.1 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 )

pkg/apis/application/v1alpha1/types.go

@@ -39,6 +39,7 @@ import (
 	"k8s.io/client-go/tools/clientcmd"
 	"k8s.io/client-go/tools/clientcmd/api"
 	"k8s.io/client-go/transport"
+	kutil "sigs.k8s.io/kustomize/api/pkg/util"
 	"sigs.k8s.io/yaml"
 
 	"github.com/argoproj/argo-cd/v3/util/hash"
@@ -685,21 +686,21 @@ func (ash *ApplicationSourceHelm) IsZero() bool {
 // KustomizeImage represents a Kustomize image definition in the format [old_image_name=]<image_name>:<image_tag>
 type KustomizeImage string
 
-func (i KustomizeImage) delim() string {
-	for _, d := range []string{"=", ":", "@"} {
-		if strings.Contains(string(i), d) {
-			return d
-		}
+// imageName returns the target image name being defined or overridden.
+// If an old image name is specified via '=', it returns the part before '='.
+// Otherwise, it returns the image name without tag and digest.
+func (i KustomizeImage) imageName() string {
+	s := string(i)
+	if name, _, ok := strings.Cut(s, "="); ok {
+		return name
 	}
-	return ":"
+	name, _, _ := kutil.SplitImageName(s)
+	return name
 }
 
-// Match returns true if the image name matches (i.e. up to the first delimiter)
+// Match returns true if the image name matches
 func (i KustomizeImage) Match(j KustomizeImage) bool {
-	delim := j.delim()
-	imageName, _, _ := strings.Cut(string(i), delim)
-	otherImageName, _, _ := strings.Cut(string(j), delim)
-	return imageName == otherImageName
+	return i.imageName() == j.imageName()
 }
 
 // KustomizeImages is a list of Kustomize images

pkg/apis/application/v1alpha1/types_test.go

@@ -2509,6 +2509,17 @@ func TestKustomizeImage_Match(t *testing.T) {
 	assert.True(t, KustomizeImage("foo:1").Match("foo:2"))
 	assert.True(t, KustomizeImage("foo@1").Match("foo@2"))
 	assert.True(t, KustomizeImage("nginx").Match("nginx"))
+
+	// registry with port
+	assert.False(t, KustomizeImage("localhost:5000/foo:1").Match("localhost:5000/bar:2"))
+	assert.False(t, KustomizeImage("registry.example.com:5000/team/foo:1.0").Match("registry.example.com:5000/team/bar:1.0"))
+	assert.True(t, KustomizeImage("localhost:5000/foo:1").Match("localhost:5000/foo:2"))
+	assert.True(t, KustomizeImage("registry.example.com:5000/team/bar:1.0").Match("registry.example.com:5000/team/bar:2.0"))
+	assert.True(t, KustomizeImage("registry.example.com:5000/team/bar").Match("registry.example.com:5000/team/bar:2.0"))
+
+	// tag vs digest
+	assert.True(t, KustomizeImage("nginx:1.25").Match("nginx@sha256:12345"))
+	assert.True(t, KustomizeImage("registry.example.com:5000/team/bar:1.0").Match("registry.example.com:5000/team/bar@sha256:12345"))
 }
 
 func TestApplicationSourceKustomize_MergeImage(t *testing.T) {
@@ -2522,6 +2533,26 @@ func TestApplicationSourceKustomize_MergeImage(t *testing.T) {
 		k.MergeImage("foo=2")
 		assert.Equal(t, KustomizeImages{"foo=2"}, k.Images)
 	})
+	t.Run("ReplaceWithRegistryPort", func(t *testing.T) {
+		k := ApplicationSourceKustomize{Images: KustomizeImages{
+			"registry.example.com:5000/team/foo:1.0",
+			"registry.example.com:5000/team/bar:1.0",
+		}}
+		k.MergeImage("registry.example.com:5000/team/bar:2.0")
+		assert.Equal(t, KustomizeImages{
+			"registry.example.com:5000/team/foo:1.0",
+			"registry.example.com:5000/team/bar:2.0",
+		}, k.Images)
+	})
+	t.Run("ReplaceTagWithDigest", func(t *testing.T) {
+		k := ApplicationSourceKustomize{Images: KustomizeImages{
+			"nginx:1.25",
+		}}
+		k.MergeImage("nginx@sha256:12345")
+		assert.Equal(t, KustomizeImages{
+			"nginx@sha256:12345",
+		}, k.Images)
+	})
 }
 
 func TestSyncWindows_HasWindows(t *testing.T) {