Replaced wait-for-it image to resolve security issues

This image was also outdated (no recent releases) and contains whole bunch of vulnerabilities

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/README.md

@@ -128,9 +128,9 @@ Kubernetes: `>=1.21.0-0`
 | spire.clusterName | string | `"example-cluster"` |  |
 | spire.trustDomain | string | `"example.org"` |  |
 | waitForIt.image.pullPolicy | string | `"IfNotPresent"` |  |
-| waitForIt.image.registry | string | `"gcr.io"` |  |
-| waitForIt.image.repository | string | `"spiffe-io/wait-for-it"` |  |
-| waitForIt.image.version | string | `""` |  |
+| waitForIt.image.registry | string | `"cgr.dev"` |  |
+| waitForIt.image.repository | string | `"chainguard/wait-for-it"` |  |
+| waitForIt.image.version | string | `"latest-20221215"` |  |
 | waitForIt.resources | object | `{}` |  |
 | workloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` |  |
 | workloadRegistrar.image.registry | string | `"gcr.io"` |  |

charts/spire/templates/agent-daemonset.yaml

@@ -31,7 +31,7 @@ spec:
           # from https://github.com/lqhl/wait-for-it
           image: {{ template "spire.image" .Values.waitForIt }}
           imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
-          args: ["-t", "30", "{{ include "spire.fullname" . }}-server:8081"]
+          args: ["-t", "30", "-h", "{{ include "spire.fullname" . }}-server", "-p", "8081"]
           resources:
             {{- toYaml .Values.waitForIt.resources | nindent 12 }}
       {{- with .Values.agent.nodeSelector }}

charts/spire/values.yaml

@@ -3,10 +3,10 @@ fullnameOverride: ""
 
 waitForIt:
   image:
-    registry: gcr.io
-    repository: spiffe-io/wait-for-it
+    registry: cgr.dev
+    repository: chainguard/wait-for-it
     pullPolicy: IfNotPresent
-    version: ""
+    version: latest-20221215
   resources: {}
 
 workloadRegistrar: