fix(kustomize): mergeKustomizeOverride is alias-blind, clobbers entries when two aliases share an image name

[chengfang]

Problem

mergeKustomizeOverride in pkg/argocd/update.go matches kustomize image entries using sameImageNameAndRegistry, which compares only ImageName + RegistryURL and ignores ImageAlias. When two aliases (e.g. service-a, service-b) target the same image name (jannfis/foobar) with distinct tags, the merge loop matches the wrong slot and clobbers one alias's update with the other's.

This is the git write-back path instance of the same bug class fixed at other layers by:

• fix(digest): pick the right live image when multiple containers share the same image #1757 — live image selection (MatchForDigestUpdate)
• fix(kustomize): match images by alias to prevent cross-alias collisions #1763 — kustomize entry read/write (GetKustomizeImage / SetKustomizeImage)

Neither PR addresses mergeKustomizeOverride.

Steps to reproduce

1. Configure an ImageUpdater CR with two aliases that share the same image name but use distinct manifestTargets.kustomize.name values (e.g. service-a=jannfis/foobar, service-b=jannfis/foobar).
2. Use git write-back (WriteBackGit).
3. Trigger an update for both aliases.

Expected: each alias's kustomize image entry is updated independently.
Actual: processing service-b's new entry matches service-a's slot first (same ImageName), overwrites it, and the old service-b entry at its original index is never updated. One alias's update is silently lost.

Relevant code

https://github.com/argoproj-labs/argocd-image-updater/blob/master/pkg/argocd/update.go#L690-L716

func mergeKustomizeOverride(t *kustomizeOverride, o *kustomizeOverride) {
    // ...
    for _, newImage := range *o.Kustomize.Images {
        newContainerImage := image.NewFromIdentifier(string(newImage))
        for idx, existingImage := range *t.Kustomize.Images {
            existingContainerImage := image.NewFromIdentifier(string(existingImage))
            if sameImageNameAndRegistry(newContainerImage, existingContainerImage) {
                // ^^^ ignores ImageAlias — matches the wrong slot
            }
        }
    }
}

Suggested fix

Add alias-awareness to the matching logic in mergeKustomizeOverride, consistent with the approach in #1763: when both the new and existing entries carry a non-empty ImageAlias, require alias equality in addition to name+registry equality.

Related

• Kustomize writeback silently skips commits when multiple aliases share the same imageName #1614 (cross-alias collision in SetKustomizeImage / GetKustomizeImage)
• Cross-Alias Tag Confusion When Two Containers Share the Same Image Name #1547 (cross-container collision in live image selection)
• fix(digest): pick the right live image when multiple containers share the same image #1757 (fix for Cross-Alias Tag Confusion When Two Containers Share the Same Image Name #1547)
• fix(kustomize): match images by alias to prevent cross-alias collisions #1763 (fix for Kustomize writeback silently skips commits when multiple aliases share the same imageName #1614)

[ekam-walia]

Hey @chengfang, I am happy to handle this issue
/assign