From 12135e15630b99629ed2e582ca2798ae2f38dbcb Mon Sep 17 00:00:00 2001
From: Kazuki Suda <kazuki.suda@gmail.com>
Date: Sat, 29 Aug 2026 13:46:14 +0900
Subject: [PATCH] fix: add CronJob Image Volume support to images transformer

The default images field spec covers spec/volumes[]/image/reference
under Pod and PodTemplateSpec, but CronJob's Image Volume under
spec/jobTemplate/spec/template/spec was missing from the list. This
adds the missing path.
---
 api/filters/imagetag/imagetag_test.go         | 44 +++++++++
 .../konfig/builtinpluginconsts/images.go      |  2 +
 api/krusty/transformersimage_test.go          | 94 +++++++++++++++++++
 3 files changed, 140 insertions(+)

diff --git a/api/filters/imagetag/imagetag_test.go b/api/filters/imagetag/imagetag_test.go
index 08cce229d..7278d76c2 100644
--- a/api/filters/imagetag/imagetag_test.go
+++ b/api/filters/imagetag/imagetag_test.go
@@ -957,6 +957,50 @@ spec:
 				},
 			},
 		},
+		"update image volume in cronjob": {
+			input: `
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: imagevolume
+spec:
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          volumes:
+          - name: volume
+            image:
+              reference: nginx
+`,
+			expectedOutput: `
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: imagevolume
+spec:
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          volumes:
+          - name: volume
+            image:
+              reference: apache@12345
+`,
+			filter: Filter{
+				ImageTag: types.Image{
+					Name:    "nginx",
+					NewName: "apache",
+					Digest:  "12345",
+				},
+			},
+			fsSlice: []types.FieldSpec{
+				{
+					Path: "spec/jobTemplate/spec/template/spec/volumes[]/image/reference",
+				},
+			},
+		},
 	}
 
 	for tn, tc := range testCases {
diff --git a/api/internal/konfig/builtinpluginconsts/images.go b/api/internal/konfig/builtinpluginconsts/images.go
index a60370ef7..dfa651d36 100644
--- a/api/internal/konfig/builtinpluginconsts/images.go
+++ b/api/internal/konfig/builtinpluginconsts/images.go
@@ -18,5 +18,7 @@ images:
   create: true
 - path: spec/template/spec/volumes[]/image/reference
   create: true
+- path: spec/jobTemplate/spec/template/spec/volumes[]/image/reference
+  create: true
 `
 )
diff --git a/api/krusty/transformersimage_test.go b/api/krusty/transformersimage_test.go
index b014f36c3..2922c9eba 100644
--- a/api/krusty/transformersimage_test.go
+++ b/api/krusty/transformersimage_test.go
@@ -440,3 +440,97 @@ spec:
         name: nginx
 `)
 }
+
+// Image Volume (KEP-4639, spec.volumes[].image) references should be
+// rewritten by the default images config wherever kustomize also rewrites
+// container images: bare Pods, PodTemplate-based workloads, and CronJob,
+// whose containers live one level deeper under spec.jobTemplate.
+func TestTransfomersImageVolumeDefaultConfig(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- pod.yaml
+- deploy.yaml
+- cronjob.yaml
+images:
+- name: nginx
+  newTag: v2
+`)
+	th.WriteF("pod.yaml", `
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod
+spec:
+  volumes:
+  - name: volume
+    image:
+      reference: nginx
+`)
+	th.WriteF("deploy.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: deploy
+spec:
+  template:
+    spec:
+      volumes:
+      - name: volume
+        image:
+          reference: nginx
+`)
+	th.WriteF("cronjob.yaml", `
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: cronjob
+spec:
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          volumes:
+          - name: volume
+            image:
+              reference: nginx
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod
+spec:
+  volumes:
+  - image:
+      reference: nginx:v2
+    name: volume
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: deploy
+spec:
+  template:
+    spec:
+      volumes:
+      - image:
+          reference: nginx:v2
+        name: volume
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: cronjob
+spec:
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          volumes:
+          - image:
+              reference: nginx:v2
+            name: volume
+`)
+}