feat(platform): pinnedTags map — chart resolves major to exact nightly

templates/_helpers.tpl

@@ -14,10 +14,49 @@ queries by-instance trivial.
 app.kubernetes.io/name: odoo
 app.kubernetes.io/instance: {{ .Values.instance.code | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
-app.kubernetes.io/version: {{ .Values.odoo.tag | quote }}
+app.kubernetes.io/version: {{ include "instance.odooTag" . | quote }}
 odoosky.io/component: instance
 {{- end -}}
 
+{{/*
+Resolved Odoo image tag.
+
+If `.Values.odoo.tag` matches a key in `.Values.odoo.pinnedTags`, the
+chart treats `odoo.tag` as a MAJOR reference (e.g. "18.0") and resolves
+it to the pinned date-stamped nightly the platform has tested
+(e.g. "18.0-20260421"). Otherwise it's used verbatim — that's the
+escape hatch for per-instance overrides during testing.
+
+This is what closes the GitOps loop: per-instance overlays carry
+`odoo.tag: "18.0"` (a major), the chart resolves to the exact pinned
+nightly. Bumping the platform's pinned image becomes a one-line edit
+to `pinnedTags` in values.yaml, propagated to every instance on next
+pod restart without touching any per-instance overlay.
+
+Source of truth for which nightly each major maps to:
+  https://git.odoosky.org/odoo-tower/odoosky-odoo (versions.yaml)
+The `pinnedTags` map in values.yaml MUST stay in sync with that file.
+*/}}
+{{- define "instance.odooTag" -}}
+{{- $tag := .Values.odoo.tag -}}
+{{- $resolved := index .Values.odoo.pinnedTags $tag -}}
+{{- if $resolved }}{{ $resolved }}{{ else }}{{ $tag }}{{ end -}}
+{{- end -}}
+
+{{/*
+Resolved full Odoo image reference (registry mirror + image + resolved
+tag). Used by every Odoo container + initContainer in the chart so a
+single edit to `pinnedTags` sweeps through every spot.
+*/}}
+{{- define "instance.odooImage" -}}
+{{- $tag := include "instance.odooTag" . -}}
+{{- if .Values.imageMirror.registry -}}
+{{ .Values.imageMirror.registry }}/{{ .Values.odoo.image }}:{{ $tag }}
+{{- else -}}
+{{ .Values.odoo.image }}:{{ $tag }}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Resources for a given role (`odoo` | `postgres`), looked up against
 the `sizes` table by `instance.size`. Falls back to "small" if the

templates/odoo-deployment.yaml

@@ -67,7 +67,7 @@ spec:
         #      and create Odoo's tables. After base is installed,
         #      `-i base` is a no-op so subsequent boots add ~5s.
         - name: db-init
-          image: "{{ if .Values.imageMirror.registry }}{{ .Values.imageMirror.registry }}/{{ end }}{{ .Values.odoo.image }}:{{ .Values.odoo.tag }}"
+          image: {{ include "instance.odooImage" . | quote }}
           imagePullPolicy: IfNotPresent
           # Override the official Odoo entrypoint so we can run psql
           # before odoo. The image ships with postgresql-client, so
@@ -202,7 +202,7 @@ spec:
         {{- end }}
       containers:
         - name: odoo
-          image: "{{ if .Values.imageMirror.registry }}{{ .Values.imageMirror.registry }}/{{ end }}{{ .Values.odoo.image }}:{{ .Values.odoo.tag }}"
+          image: {{ include "instance.odooImage" . | quote }}
           imagePullPolicy: IfNotPresent
           # Pin the active database to our tenant code. Without this
           # Odoo runs in multi-DB mode and exposes /web/database/manager;