Location: base/minio/stateful-set.yaml:33 (5stack-panel)
What: The object store (quay.io/minio/minio:latest, line 33) and the media server (bluenviron/mediamtx:latest, overlays/mediamtx/deployment.yaml:33) reference the mutable latest tag. Because the tag is literally latest, Kubernetes defaults imagePullPolicy to Always, so every pod restart or reschedule pulls whatever latest currently points to upstream. TimescaleDB (base/timescaledb/stateful-set.yaml:31) similarly uses the floating latest-pg17 tag, pulled on any new-node schedule. None of these upstream images are controlled by 5stack.
Impact: MinIO ships a breaking release (it has removed the embedded console and changed server flags in past releases); the next node reboot or pod eviction pulls that new image, the minio server/mc startup script in this StatefulSet fails on the removed/renamed flag, and the S3 layer serving demos, clips, snapshots, and DB backups fails to come up with no code change on the operator's side.
Suggested fix: Pin third-party data-layer and media images to specific version tags (ideally by digest) and bump them deliberately, rather than tracking latest/latest-pg17.
Verifier evidence
base/minio/stateful-set.yaml:33 image: quay.io/minio/minio:latest; overlays/mediamtx/deployment.yaml:33 image: bluenviron/mediamtx:latest; base/timescaledb/stateful-set.yaml:31 image: timescale/timescaledb:latest-pg17. grep for imagePullPolicy across base/minio, base/timescaledb, overlays/mediamtx returned no matches, so defaults apply (Always for the latest tags).
Found by the 2026-07 multi-agent code audit; adversarially verified (CONFIRMED, P2). One of a batch of findings from that pass.
Location:
base/minio/stateful-set.yaml:33(5stack-panel)What: The object store (quay.io/minio/minio:latest, line 33) and the media server (bluenviron/mediamtx:latest, overlays/mediamtx/deployment.yaml:33) reference the mutable
latesttag. Because the tag is literallylatest, Kubernetes defaults imagePullPolicy to Always, so every pod restart or reschedule pulls whateverlatestcurrently points to upstream. TimescaleDB (base/timescaledb/stateful-set.yaml:31) similarly uses the floatinglatest-pg17tag, pulled on any new-node schedule. None of these upstream images are controlled by 5stack.Impact: MinIO ships a breaking release (it has removed the embedded console and changed server flags in past releases); the next node reboot or pod eviction pulls that new image, the
minio server/mcstartup script in this StatefulSet fails on the removed/renamed flag, and the S3 layer serving demos, clips, snapshots, and DB backups fails to come up with no code change on the operator's side.Suggested fix: Pin third-party data-layer and media images to specific version tags (ideally by digest) and bump them deliberately, rather than tracking
latest/latest-pg17.Verifier evidence
base/minio/stateful-set.yaml:33
image: quay.io/minio/minio:latest; overlays/mediamtx/deployment.yaml:33image: bluenviron/mediamtx:latest; base/timescaledb/stateful-set.yaml:31image: timescale/timescaledb:latest-pg17. grep forimagePullPolicyacross base/minio, base/timescaledb, overlays/mediamtx returned no matches, so defaults apply (Always for thelatesttags).Found by the 2026-07 multi-agent code audit; adversarially verified (CONFIRMED, P2). One of a batch of findings from that pass.