diff --git a/.github/tests/images.json b/.github/tests/images.json index 9df5b9f..bc79258 100644 --- a/.github/tests/images.json +++ b/.github/tests/images.json @@ -38,6 +38,11 @@ "query": "nodeDriverRegistrar.image", "filter": "^v", "sort-flags": [] + }, + { + "query": "selinux.image", + "filter": "^[0-9]\\+\\.[0-9]\\+-[0-9]\\+$", + "sort-flags": [] } ], "spiffe-oidc-discovery-provider/values.yaml": [ diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index 3bcc62e..7689d8f 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -73,6 +73,6 @@ A Helm chart to install the SPIFFE CSI driver. | `selinux.context` | Which selinux context to use | `container_file_t` | | `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` | | `selinux.image.repository` | The repository within the registry | `ubi9` | -| `selinux.image.pullPolicy` | The image pull policy | `Always` | -| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest` | +| `selinux.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.6-1754586119` | diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index e293e4c..0fdbd17 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -172,5 +172,5 @@ selinux: image: registry: registry.access.redhat.com repository: ubi9 - pullPolicy: Always - tag: latest + pullPolicy: IfNotPresent + tag: 9.6-1754586119 diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 270afd2..717b024 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -69,7 +69,7 @@ A Helm chart to install the SPIRE agent. | `readinessProbe.periodSeconds` | Period seconds for probe | `30` | | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | -| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | +| `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:330ad2ea11cf3018a331326fb08e44cedd0c0c604cfbfcff32b81272460bb679` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | @@ -118,7 +118,7 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` | | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | -| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` | +| `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:330ad2ea11cf3018a331326fb08e44cedd0c0c604cfbfcff32b81272460bb679` | | `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index a42dc99..1db154d 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -152,7 +152,7 @@ fsGroupFix: image: registry: cgr.dev repository: chainguard/bash - pullPolicy: Always + pullPolicy: IfNotPresent tag: latest@sha256:330ad2ea11cf3018a331326fb08e44cedd0c0c604cfbfcff32b81272460bb679 ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ @@ -292,7 +292,7 @@ socketAlternate: image: registry: cgr.dev repository: chainguard/bash - pullPolicy: Always + pullPolicy: IfNotPresent tag: latest@sha256:330ad2ea11cf3018a331326fb08e44cedd0c0c604cfbfcff32b81272460bb679 ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 74faf4a..cbb8d35 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -474,7 +474,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` | | `chown.image.registry` | The OCI registry to pull the image from | `""` | | `chown.image.repository` | The repository within the registry | `busybox` | -| `chown.image.pullPolicy` | The image pull policy | `Always` | +| `chown.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` | | `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `experimental.enabled` | Allow configuration of experimental features | `false` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index e9d3d56..317c108 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1207,7 +1207,7 @@ chown: image: registry: "" repository: busybox - pullPolicy: Always + pullPolicy: IfNotPresent tag: 1.37.0-uclibc ## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ diff --git a/examples/mysql-using-spire/mysql-values.yaml b/examples/mysql-using-spire/mysql-values.yaml index 57ecbf9..f832e7d 100644 --- a/examples/mysql-using-spire/mysql-values.yaml +++ b/examples/mysql-using-spire/mysql-values.yaml @@ -32,7 +32,7 @@ primary: mountPath: /helper - name: init-tls image: ghcr.io/spiffe/spiffe-helper:0.8.0 - imagePullPolicy: Always + imagePullPolicy: IfNotPresent command: - /spiffe-helper - -config diff --git a/examples/mysql-using-spire/mysqlclient-statefulset.yaml b/examples/mysql-using-spire/mysqlclient-statefulset.yaml index 3132580..293684a 100644 --- a/examples/mysql-using-spire/mysqlclient-statefulset.yaml +++ b/examples/mysql-using-spire/mysqlclient-statefulset.yaml @@ -17,7 +17,7 @@ spec: initContainers: - name: init-tls image: ghcr.io/spiffe/spiffe-helper:0.8.0 - imagePullPolicy: Always + imagePullPolicy: IfNotPresent command: - /spiffe-helper - -config @@ -48,7 +48,7 @@ spec: mountPath: /certs - name: refresh-tls image: ghcr.io/spiffe/spiffe-helper:0.8.0 - imagePullPolicy: Always + imagePullPolicy: IfNotPresent command: - /spiffe-helper - -config