panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update imagePullPolicy to IfNotPresent (#643)

Browse Source 
* Change selinux image pullpolicy and tag version

Signed-off-by: Eric Cavalcanti <[email protected]>

* Change image pullpolicy

Signed-off-by: Eric Cavalcanti <[email protected]>

* Update readme

Signed-off-by: Eric Cavalcanti <[email protected]>

* update examples

Signed-off-by: Eric Cavalcanti <[email protected]>

* Update image pullpolicy

Signed-off-by: Eric Cavalcanti <[email protected]>

* Fix readme as well

Signed-off-by: Eric Cavalcanti <[email protected]>

* Undo pullpolicy readme

Signed-off-by: Eric Cavalcanti <[email protected]>

* Add selinux

Signed-off-by: Eric Cavalcanti <[email protected]>

* Revert code block

Signed-off-by: Eric Cavalcanti <[email protected]>

* Change regex

Signed-off-by: Eric Cavalcanti <[email protected]>

---------

Signed-off-by: Eric Cavalcanti <[email protected]>
This commit is contained in:
Eric Cavalcanti
2025-08-11 06:19:27 -07:00
committed by GitHub
parent 86f0aecc57
commit 5e40cfb222
9 changed files with 18 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/tests/images.json
+5
View File
@@ -38,6 +38,11 @@
"query": "nodeDriverRegistrar.image", "query": "nodeDriverRegistrar.image",
"filter": "^v", "filter": "^v",
"sort-flags": [] "sort-flags": []
},
{
"query": "selinux.image",
"filter": "^[0-9]\\+\\.[0-9]\\+-[0-9]\\+$",
"sort-flags": []
} }
], ],
"spiffe-oidc-discovery-provider/values.yaml": [ "spiffe-oidc-discovery-provider/values.yaml": [
charts/spire/charts/spiffe-csi-driver/README.md
+2 -2
View File
@@ -73,6 +73,6 @@ A Helm chart to install the SPIFFE CSI driver.
| `selinux.context` | Which selinux context to use | `container_file_t` | | `selinux.context` | Which selinux context to use | `container_file_t` |
| `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` | | `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` |
| `selinux.image.repository` | The repository within the registry | `ubi9` | | `selinux.image.repository` | The repository within the registry | `ubi9` |
| `selinux.image.pullPolicy` | The image pull policy | `Always` | | `selinux.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest` | | `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.6-1754586119` |
charts/spire/charts/spiffe-csi-driver/values.yaml
+2 -2
View File
@@ -172,5 +172,5 @@ selinux:
image: image:
registry: registry.access.redhat.com registry: registry.access.redhat.com
repository: ubi9 repository: ubi9
pullPolicy: Always pullPolicy: IfNotPresent
tag: latest tag: 9.6-1754586119
charts/spire/charts/spire-agent/README.md
+2 -2
View File
@@ -69,7 +69,7 @@ A Helm chart to install the SPIRE agent.
| `readinessProbe.periodSeconds` | Period seconds for probe | `30` | | `readinessProbe.periodSeconds` | Period seconds for probe | `30` |
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:330ad2ea11cf3018a331326fb08e44cedd0c0c604cfbfcff32b81272460bb679` | | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:330ad2ea11cf3018a331326fb08e44cedd0c0c604cfbfcff32b81272460bb679` |
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
@@ -118,7 +118,7 @@ A Helm chart to install the SPIRE agent.
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` | | `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` | | `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:330ad2ea11cf3018a331326fb08e44cedd0c0c604cfbfcff32b81272460bb679` | | `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:330ad2ea11cf3018a331326fb08e44cedd0c0c604cfbfcff32b81272460bb679` |
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
charts/spire/charts/spire-agent/values.yaml
+2 -2
View File
@@ -152,7 +152,7 @@ fsGroupFix:
image: image:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: Always pullPolicy: IfNotPresent
tag: latest@sha256:330ad2ea11cf3018a331326fb08e44cedd0c0c604cfbfcff32b81272460bb679 tag: latest@sha256:330ad2ea11cf3018a331326fb08e44cedd0c0c604cfbfcff32b81272460bb679
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
@@ -292,7 +292,7 @@ socketAlternate:
image: image:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: Always pullPolicy: IfNotPresent
tag: latest@sha256:330ad2ea11cf3018a331326fb08e44cedd0c0c604cfbfcff32b81272460bb679 tag: latest@sha256:330ad2ea11cf3018a331326fb08e44cedd0c0c604cfbfcff32b81272460bb679
## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
charts/spire/charts/spire-server/README.md
+1 -1
View File
@@ -474,7 +474,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` | | `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` |
| `chown.image.registry` | The OCI registry to pull the image from | `""` | | `chown.image.registry` | The OCI registry to pull the image from | `""` |
| `chown.image.repository` | The repository within the registry | `busybox` | | `chown.image.repository` | The repository within the registry | `busybox` |
| `chown.image.pullPolicy` | The image pull policy | `Always` | | `chown.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` | | `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` |
| `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `experimental.enabled` | Allow configuration of experimental features | `false` | | `experimental.enabled` | Allow configuration of experimental features | `false` |
charts/spire/charts/spire-server/values.yaml
+1 -1
View File
@@ -1207,7 +1207,7 @@ chown:
image: image:
registry: "" registry: ""
repository: busybox repository: busybox
pullPolicy: Always pullPolicy: IfNotPresent
tag: 1.37.0-uclibc tag: 1.37.0-uclibc
## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ ## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
examples/mysql-using-spire/mysql-values.yaml
+1 -1
View File
@@ -32,7 +32,7 @@ primary:
mountPath: /helper mountPath: /helper
- name: init-tls - name: init-tls
image: ghcr.io/spiffe/spiffe-helper:0.8.0 image: ghcr.io/spiffe/spiffe-helper:0.8.0
imagePullPolicy: Always imagePullPolicy: IfNotPresent
command: command:
- /spiffe-helper - /spiffe-helper
- -config - -config
examples/mysql-using-spire/mysqlclient-statefulset.yaml
+2 -2
View File
@@ -17,7 +17,7 @@ spec:
initContainers: initContainers:
- name: init-tls - name: init-tls
image: ghcr.io/spiffe/spiffe-helper:0.8.0 image: ghcr.io/spiffe/spiffe-helper:0.8.0
imagePullPolicy: Always imagePullPolicy: IfNotPresent
command: command:
- /spiffe-helper - /spiffe-helper
- -config - -config
@@ -48,7 +48,7 @@ spec:
mountPath: /certs mountPath: /certs
- name: refresh-tls - name: refresh-tls
image: ghcr.io/spiffe/spiffe-helper:0.8.0 image: ghcr.io/spiffe/spiffe-helper:0.8.0
imagePullPolicy: Always imagePullPolicy: IfNotPresent
command: command:
- /spiffe-helper - /spiffe-helper
- -config - -config