Multi-source helm digest image update does not update image digest

[kristeey]

Describe the bug
When using multi-source Application for helm installation (one source pointing at the helm chart, and one pointing at the values file) together with ImageUpdater CR does not work as expected.
I have seen some wierd behavior:

• Image Updater manages to find the Argo Application that has a never dev image in the ACR
• The Image Updater "updates" the image tag to the same value as it already has. Successfully updated image '<my-acr>.azurecr.io/my-app:b0f5b' to '<my-acr>.azurecr.io/my-app:b0f5b', but pending spec update (dry run=false)"
• The Image updater pushes .argocd-source-argocd_my-app-dev.yaml file to the repo containing info about image name and tag.
• Logs indications that everything went smoothly and the image update is done, which is not actually the case.
• Continues to do all of this over and over again. Never actually updating the image

To Reproduce
Application:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  labels:
    autoImageUpdateEnabled: "true"
    environment: dev
  name: my-app-dev
  namespace: argocd
spec:
  destination:
    namespace: <my-namespace>
    server: https://kubernetes.default.svc
  project: my-app
  sources:
  - ref: valuesrepo
    repoURL: https://github.com/<org>/<gitops-repo>.git
    targetRevision: main
  - chart: my-chart
    helm:
      valueFiles:
      - $valuesrepo/apps/my-app/dev/values.yaml
    repoURL: https://<chart-url>
    targetRevision: 0.0.8
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=true
    - ServerSideApply=true

Install image updater 1.0.1 in argocd-image-updater-system namespace
ImageUpdater:

apiVersion: argocd-image-updater.argoproj.io/v1alpha1
kind: ImageUpdater
metadata:
  name: my-app-dev
  namespace: argocd-image-updater-system
spec:
  namespace: argocd
  writeBackConfig:
    method: "git:secret:argocd-image-updater-system/git-creds"
    gitConfig:
      repository: "git@github.com:<org>/<gitops-repo>.git"
      branch: "main"
  commonUpdateSettings:
    updateStrategy: digest
  applicationRefs:
    - namePattern: "my-app-dev"
      labelSelectors:
        matchLabels:
          environment: dev
          autoImageUpdateEnabled: "true"
      images:
        - alias: my-app
          imageName: "<my-acr>.azurecr.io/my-app:dev"
          manifestTargets:
            helm:
              name: "image.name"
              tag: "image.tag"

Helm values:

...
image:
  name: "<my-acr>.azurecr.io/my-app"
  tag: "b0f5b"
...

Expected behavior
Observe ImageUpdater updating b0f5b tag to the latest image SHA digest in Git repo and not starting new update loops if not necessary.

Additional context
I have tested with different image tags that exists in the ACR. But the same behavior exists for all of them.

Version
1.0.1

Regression
Does this issue apply to (check all that apply):

• Annotation-based configuration (versions starting with 0, e.g., 0.17.0)
• CRD-based configuration (versions starting with 1, e.g., 1.0.0)

Latest working version (if applicable)
If you are reporting a regression, please specify the last version where this feature worked as expected.

Logs

Default container name "manager" not found in pod argocd-image-updater-controller-5b46fc4fc7-tldml
time="2025-11-30T21:21:10Z" level=info msg="Controller runtime logger initialized." controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater logger=controller-setup setAppLogLevel=info
time="2025-11-30T21:21:10Z" level=info msg=starting app="argocd-image-updater: v1.0.1+cc39181" controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater healthPort=":8081" interval=2m0s logger=controller-setup loglevel=INFO
time="2025-11-30T21:21:10Z" level=info msg="commit message template not found, using default" controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater logger=controller-setup path=/app/config/commit.template
time="2025-11-30T21:21:10Z" level=info msg="Loaded 1 registry configurations from /app/config/registries.conf"
time="2025-11-30T21:21:10Z" level=info msg="Adding cache warmer to the manager." controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater logger=controller-setup
time="2025-11-30T21:21:10Z" level=info msg="Adding Webhook Server as a Runnable to the manager." controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater logger=controller-setup
time="2025-11-30T21:21:10Z" level=info msg="webhook server is disabled, skip adding webhook server runnable to manager" controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater logger=controller-setup
time="2025-11-30T21:21:10Z" level=info msg="starting manager" controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater logger=controller-setup
time="2025-11-30T21:21:10Z" level=info msg="Starting metrics server" logger=controller-runtime.metrics
time="2025-11-30T21:21:10Z" level=info msg="Disabling HTTP/2 support" controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater logger=controller-setup
I1130 21:21:10.029140       1 leaderelection.go:257] attempting to acquire leader lease argocd-image-updater-system/c21b75f2.argoproj.io...
time="2025-11-30T21:21:10Z" level=info msg="starting server" addr="[::]:8081" name="health probe"
time="2025-11-30T21:21:10Z" level=info msg="Serving metrics server" bindAddress=":8443" logger=controller-runtime.metrics secure=true
time="2025-11-30T21:21:21Z" level=info msg="healthz check failed" logger=controller-runtime.healthz statuses="[{}]"
I1130 21:21:25.447125       1 leaderelection.go:271] successfully acquired lease argocd-image-updater-system/c21b75f2.argoproj.io
time="2025-11-30T21:21:25Z" level=info msg="Starting EventSource" controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater source="kind source: *v1alpha1.ImageUpdater"
...[TRUNCATED]...
time="2025-11-30T21:22:31Z" level=info msg="Successfully fetched ImageUpdater resource." controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater imageUpdater_name=my-app-dev imageUpdater_namespace=argocd-image-updater-system logger=reconcile
time="2025-11-30T21:22:31Z" level=info msg="Listing all applications in target namespace: argocd" controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater imageUpdater_name=my-app-dev imageUpdater_namespace=argocd-image-updater-system logger=reconcile
time="2025-11-30T21:22:31Z" level=info msg="Starting image update cycle, considering 1 application(s) for update" controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater imageUpdater_name=my-app-dev imageUpdater_namespace=argocd-image-updater-system logger=reconcile
time="2025-11-30T21:22:34Z" level=info msg="Setting new image to <my-acr>.azurecr.io/my-app:b0f5b" application=argocd/my-app-dev controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater imageUpdater_name=my-app-dev imageUpdater_namespace=argocd-image-updater-system image_alias=my-app image_name=<my-acr>.azurecr.io/my-app image_registry=<my-acr>.azurecr.io image_tag=b0f5b logger=reconcile
time="2025-11-30T21:22:34Z" level=info msg="Successfully updated image '<my-acr>.azurecr.io/my-app:b0f5b' to '<my-acr>.azurecr.io/my-app:b0f5b', but pending spec update (dry run=false)" application=argocd/my-app-dev controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater imageUpdater_name=my-app-dev imageUpdater_namespace=argocd-image-updater-system image_alias=my-app image_name=<my-acr>.azurecr.io/my-app image_registry=<my-acr>.azurecr.io image_tag=b0f5b logger=reconcile
time="2025-11-30T21:22:34Z" level=info msg="Committing 1 parameter update(s) for application my-app-dev" application=argocd/my-app-dev controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater imageUpdater_name=my-app-dev imageUpdater_namespace=argocd-image-updater-system logger=reconcile
time="2025-11-30T21:22:34Z" level=info msg="Initializing git@github.com:<org>/<gitops-repo>.git to /tmp/git-my-app-dev1783019028" application=argocd/my-app-dev controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater imageUpdater_name=my-app-dev imageUpdater_namespace=argocd-image-updater-system logger=reconcile
time="2025-11-30T21:22:34Z" level=warning msg="temporarily disabling strict host key checking (i.e. '-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'), please don't use in production" application=argocd/my-app-dev controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater imageUpdater_name=my-app-dev imageUpdater_namespace=argocd-image-updater-system logger=reconcile
time="2025-11-30T21:22:34Z" level=info msg="git fetch origin main --force --prune --depth 1" dir=/tmp/git-my-app-dev1783019028 execID=02b6a
{"args":"[git fetch origin main --force --prune --depth 1]","dir":"/tmp/git-my-app-dev1783019028","level":"info","msg":"Trace","operation_name":"exec git","time":"2025-11-30T21:22:35Z","time_ms":1598.2002870000001}
time="2025-11-30T21:22:35Z" level=info msg="git checkout --force main" dir=/tmp/git-my-app-dev1783019028 execID=0fcf3
{"args":"[git checkout --force main]","dir":"/tmp/git-my-app-dev1783019028","level":"info","msg":"Trace","operation_name":"exec git","time":"2025-11-30T21:22:35Z","time_ms":7.226624}
time="2025-11-30T21:22:35Z" level=info msg="git clean -ffdx" dir=/tmp/git-my-app-dev1783019028 execID=45fc5
{"args":"[git clean -ffdx]","dir":"/tmp/git-my-app-dev1783019028","level":"info","msg":"Trace","operation_name":"exec git","time":"2025-11-30T21:22:35Z","time_ms":1.1277940000000002}
time="2025-11-30T21:22:35Z" level=info msg="git add /tmp/git-my-app-dev1783019028/.argocd-source-argocd_my-app-dev.yaml" dir=/tmp/git-my-app-dev1783019028 execID=b8eb2
time="2025-11-30T21:22:35Z" level=warning msg="temporarily disabling strict host key checking (i.e. '-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'), please don't use in production" application=argocd/my-app-dev controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater imageUpdater_name=my-app-dev imageUpdater_namespace=argocd-image-updater-system logger=reconcile
{"args":"[git add /tmp/git-my-app-dev1783019028/.argocd-source-argocd_my-app-dev.yaml]","dir":"/tmp/git-my-app-dev1783019028","level":"info","msg":"Trace","operation_name":"exec git","time":"2025-11-30T21:22:35Z","time_ms":1.640276}
time="2025-11-30T21:22:35Z" level=info msg="git config user.name argocd-image-updater" dir=/tmp/git-my-app-dev1783019028 execID=355a2
{"args":"[git config user.name argocd-image-updater]","dir":"/tmp/git-my-app-dev1783019028","level":"info","msg":"Trace","operation_name":"exec git","time":"2025-11-30T21:22:35Z","time_ms":0.8100130000000001}
time="2025-11-30T21:22:35Z" level=info msg="git config user.email noreply@argoproj.io" dir=/tmp/git-my-app-dev1783019028 execID=e6a7d
{"args":"[git config user.email noreply@argoproj.io]","dir":"/tmp/git-my-app-dev1783019028","level":"info","msg":"Trace","operation_name":"exec git","time":"2025-11-30T21:22:35Z","time_ms":1.949182}
time="2025-11-30T21:22:35Z" level=info msg="git -c gpg.format=openpgp commit -a -F /tmp/image-updater-commit-msg853051799" dir=/tmp/git-my-app-dev1783019028 execID=d224f
{"args":"[git -c gpg.format=openpgp commit -a -F /tmp/image-updater-commit-msg853051799]","dir":"/tmp/git-my-app-dev1783019028","level":"info","msg":"Trace","operation_name":"exec git","time":"2025-11-30T21:22:35Z","time_ms":7.684316}
time="2025-11-30T21:22:35Z" level=warning msg="temporarily disabling strict host key checking (i.e. '-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'), please don't use in production" application=argocd/my-app-dev controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater imageUpdater_name=my-app-dev imageUpdater_namespace=argocd-image-updater-system logger=reconcile
time="2025-11-30T21:22:35Z" level=info msg="git push origin main" dir=/tmp/git-my-app-dev1783019028 execID=f25b2
{"args":"[git push origin main]","dir":"/tmp/git-my-app-dev1783019028","level":"info","msg":"Trace","operation_name":"exec git","time":"2025-11-30T21:22:37Z","time_ms":1567.2017110000002}
time="2025-11-30T21:22:37Z" level=info msg="Successfully updated the live application spec" application=argocd/my-app-dev controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater imageUpdater_name=my-app-dev imageUpdater_namespace=argocd-image-updater-system logger=reconcile
time="2025-11-30T21:22:37Z" level=info msg="Processing results: applications=1 images_considered=1 images_skipped=0 images_updated=1 errors=0" controller=imageupdater controllerGroup=argocd-image-updater.argoproj.io controllerKind=ImageUpdater imageUpdater_name=my-app-dev imageUpdater_namespace=argocd-image-updater-system logger=reconcile

[dkarpele]

Thanks for reporting.
I assume you have encountered #1343. The target file name is wrong, it should be .argocd-source-<app_name>.yaml in your case.
Could you please try to apply workaround #1343 (comment)

[kristeey]

thanks, after adding writeBackTarget to the ImageUpdater like so

    - namePattern: "my-app-dev"
      labelSelectors:
        matchLabels:
          environment: dev
          autoImageUpdateEnabled: "true"
      writeBackConfig:
        gitConfig:
          writeBackTarget: helmvalues:/apps/my-app/dev/values.yaml

I started seeing som new behavior.

1. a values.yaml file is added to the root of the repo containing the correct referecence to the SHA digest dev image.
2. The deployment/pod in the cluster gets updated with the new image, but after a a reconciliation loop flips back to what is within the target file /apps/my-app/dev/values.yaml.

I believe there is a conflict where argo and argo image updater battles between updating as the /apps/my-app/dev/values.yaml contains the old image value, and argo image updater updates the image directly? I suspect the created values.yaml file at root level in the repo does not actually do anything at this point. Shouldn't it update the /apps/my-app/dev/values.yaml directly?