feat(platform): pinnedTags map — chart resolves major to exact nightly

templates/_helpers.tpl

@@ -14,10 +14,49 @@ queries by-instance trivial.
 app.kubernetes.io/name: odoo
 app.kubernetes.io/instance: {{ .Values.instance.code | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
-app.kubernetes.io/version: {{ .Values.odoo.tag | quote }}
+app.kubernetes.io/version: {{ include "instance.odooTag" . | quote }}
 odoosky.io/component: instance
 {{- end -}}
 
+{{/*
+Resolved Odoo image tag.
+
+If `.Values.odoo.tag` matches a key in `.Values.odoo.pinnedTags`, the
+chart treats `odoo.tag` as a MAJOR reference (e.g. "18.0") and resolves
+it to the pinned date-stamped nightly the platform has tested
+(e.g. "18.0-20260421"). Otherwise it's used verbatim — that's the
+escape hatch for per-instance overrides during testing.
+
+This is what closes the GitOps loop: per-instance overlays carry
+`odoo.tag: "18.0"` (a major), the chart resolves to the exact pinned
+nightly. Bumping the platform's pinned image becomes a one-line edit
+to `pinnedTags` in values.yaml, propagated to every instance on next
+pod restart without touching any per-instance overlay.
+
+Source of truth for which nightly each major maps to:
+  https://git.odoosky.org/odoo-tower/odoosky-odoo (versions.yaml)
+The `pinnedTags` map in values.yaml MUST stay in sync with that file.
+*/}}
+{{- define "instance.odooTag" -}}
+{{- $tag := .Values.odoo.tag -}}
+{{- $resolved := index .Values.odoo.pinnedTags $tag -}}
+{{- if $resolved }}{{ $resolved }}{{ else }}{{ $tag }}{{ end -}}
+{{- end -}}
+
+{{/*
+Resolved full Odoo image reference (registry mirror + image + resolved
+tag). Used by every Odoo container + initContainer in the chart so a
+single edit to `pinnedTags` sweeps through every spot.
+*/}}
+{{- define "instance.odooImage" -}}
+{{- $tag := include "instance.odooTag" . -}}
+{{- if .Values.imageMirror.registry -}}
+{{ .Values.imageMirror.registry }}/{{ .Values.odoo.image }}:{{ $tag }}
+{{- else -}}
+{{ .Values.odoo.image }}:{{ $tag }}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Resources for a given role (`odoo` | `postgres`), looked up against
 the `sizes` table by `instance.size`. Falls back to "small" if the

templates/odoo-deployment.yaml

@@ -67,7 +67,7 @@ spec:
         #      and create Odoo's tables. After base is installed,
         #      `-i base` is a no-op so subsequent boots add ~5s.
         - name: db-init
-          image: "{{ if .Values.imageMirror.registry }}{{ .Values.imageMirror.registry }}/{{ end }}{{ .Values.odoo.image }}:{{ .Values.odoo.tag }}"
+          image: {{ include "instance.odooImage" . | quote }}
           imagePullPolicy: IfNotPresent
           # Override the official Odoo entrypoint so we can run psql
           # before odoo. The image ships with postgresql-client, so
@@ -202,7 +202,7 @@ spec:
         {{- end }}
       containers:
         - name: odoo
-          image: "{{ if .Values.imageMirror.registry }}{{ .Values.imageMirror.registry }}/{{ end }}{{ .Values.odoo.image }}:{{ .Values.odoo.tag }}"
+          image: {{ include "instance.odooImage" . | quote }}
           imagePullPolicy: IfNotPresent
           # Pin the active database to our tenant code. Without this
           # Odoo runs in multi-DB mode and exposes /web/database/manager;

values.yaml

@@ -99,10 +99,31 @@ imageMirror:
 
 odoo:
   image: odoo
-  # Pinned to upstream nightly. NEVER use rolling tags (18.0, 17.0, 16.0).
-  # See odoo-tower/odoosky-odoo/versions.yaml for the canonical list and
-  # the bump procedure.
-  tag: "18.0-20260421"
+  # `tag` may be either a MAJOR reference ("18.0") or a literal pinned
+  # tag ("18.0-20260421"). When it's a major, the chart resolves it via
+  # `pinnedTags` below — that's the GitOps-clean path. Per-instance
+  # overlays should carry the major; the chart owns the exact nightly.
+  # Literal tags here are an escape hatch for staging tests.
+  tag: "18.0"
+
+  # pinnedTags — major → exact upstream nightly we have tested.
+  # MUST stay in sync with odoo-tower/odoosky-odoo/versions.yaml; that
+  # repo is the source of truth + bump policy. To bump:
+  #   1. Test the candidate nightly (see odoosky-odoo README).
+  #   2. Mirror it: nerdctl pull → tag → push to docker-mirror.
+  #   3. Update BOTH versions.yaml AND this map in the same PR.
+  #   4. ArgoCD reconciles; every instance of that major picks up the
+  #      new image on next pod restart, no overlay edits.
+  #
+  # Adding a new major: add an entry here. Tower's renderer writes the
+  # major as `odoo.tag` — adding "17.0" / "19.0" here lights up that
+  # major across every instance that asks for it.
+  pinnedTags:
+    "18.0": "18.0-20260421"
+    # "17.0": "..."   # add when 17.0 is brought into the platform
+    # "16.0": "..."   # add when 16.0 is brought into the platform
+    # "19.0": "..."   # add when 19.0 is brought into the platform
+
   # Filestore PVC size (Odoo's /var/lib/odoo).
   filestoreSize: 10Gi