fix: skip component_image_tags for components outside the kubescape-operator chart

[matthyx]

Summary

• incluster-comp-pr-merged.yaml unconditionally sent client_payload[component_image_tags]=<COMPONENT_NAME>-tag=<tag> on every Helm E2E dispatch, even for components that aren't part of the kubescape-operator chart (http-request, prometheus-exporter).
• Since armosec/system-tests#1236 (merged 2026-08-31) started fail-closing on unrecognised *-tag overrides, every release of those non-chart components now fails ks_microservice_on_demand with unknown component image tag kwargs ['http-request-tag'] — expected one of [...], which blocks create-release-and-retag.
• Fix: only append component_image_tags when COMPONENT_NAME is one of the chart's known components (kubescape, operator, kubevuln, kollector, gateway, storage, nodeAgent).

Root cause

Full trace: kubescape/http-request#29 merged → incluster-comp-pr-merged.yaml dispatched component_image_tags=http-request-tag=... to armosec/shared-workflows → armosec/system-tests's tests_scripts/helm/base_helm.py:get_in_cluster_tags() rejects it as unknown (allowlist is systest_utils/statics.py:COMPONENT_TAGS, which has no http-request entry — http-request isn't in kubescape/helm-charts either). Failing run: https://github.com/armosec/shared-workflows/actions/runs/33526635646/job/99921734558

Before armosec/system-tests#1236, the unrecognised kwarg was silently dropped (extract_tag_from_kwargs), so this was a latent no-op bug, not a failure. prometheus-exporter has the identical HELM_E2E_TEST: true + non-chart COMPONENT_NAME setup and is very likely broken the same way.

Verified safe

armosec/shared-workflows/.github/workflows/helm-e2e-receiver.yaml:60 already does COMPONENT_IMAGE_TAGS: ${{ github.event.client_payload.component_image_tags || '' }} — omitting the payload key entirely degrades to the same empty-string default it already handles. No change needed on the receiving side, and chart-component consumers (operator, kubevuln, storage, nodeAgent, ...) are unaffected.

Test plan

• YAML validated (python3 -c "import yaml; yaml.safe_load(...)")
• Re-run/merge a component whose COMPONENT_NAME is in the chart allowlist (e.g. storage) and confirm component_image_tags is still sent and its E2E test still passes
• Re-run kubescape/http-request's release (or dispatch manually) and confirm ks_microservice_on_demand no longer fails with unknown component image tag kwargs

🤖 Generated with Claude Code

AI-skills: armosec-shared-rules:investigate-system-test-failure

[github-actions]

Summary:

• License scan: failure
• Credentials scan: failure
• Vulnerabilities scan: failure
• Unit test: success
• Go linting: failure

[github-actions]

Summary:

• License scan: failure
• Credentials scan: failure
• Vulnerabilities scan: failure
• Unit test: success
• Go linting: failure

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 16facc82-3be3-4889-a33a-3a566a29c73f

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}