panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tools: Replace rancher/kubectl with registry.k8s.io/kubectl

Browse Source 
To have an always up to date kubectl image it is probably better to get kubectl from registry.k8s.io

Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2025-07-08 19:24:08 +02:00
parent fc1791f2eb
commit a7d536c025
8 changed files with 14 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
-9
View File
@@ -24,11 +24,6 @@ Preparing a production deployment requires a few steps.
1. Save the following to your-values.yaml, ideally in your git repo.
> [!NOTE]
> Please note that `rancher/kubectl` image does not always correspond to the most
> recent version of Kubernetes. In order to find the most up-to-date version,
> please visit their [releases](https://github.com/rancher/kubectl/releases) page.
```yaml
global:
openshift: false # If running on openshift, set to true
@@ -45,10 +40,6 @@ global:
country: ARPA
organization: Example
commonName: example.org
# If rancher/kubectl doesn't have a version that matches your cluster, uncomment and update:
# tools:
# kubectl:
# tag: "v1.23.3"
```
2. If you need a non default storageClass, append the following to the global.spire section and update:
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+2 -2
View File
@@ -139,7 +139,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` |
| `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.agent.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` |
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+2 -2
View File
@@ -404,7 +404,7 @@ tools:
## @param tools.kubectl.image.tag Overrides the image tag whose default is the chart appVersion
##
image:
registry: docker.io
repository: rancher/kubectl
registry: registry.k8s.io
repository: kubectl
pullPolicy: IfNotPresent
tag: ""
charts/spire/charts/spire-agent/README.md
+2 -2
View File
@@ -136,8 +136,8 @@ A Helm chart to install the SPIRE agent.
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
| `experimental.featureFlags` | List of developer feature flags | `[]` |
| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` |
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` |
charts/spire/charts/spire-agent/values.yaml
+2 -2
View File
@@ -370,8 +370,8 @@ tools:
## @param tools.kubectl.image.tag Overrides the image tag whose default is the chart appVersion
##
image:
registry: docker.io
repository: rancher/kubectl
registry: registry.k8s.io
repository: kubectl
pullPolicy: IfNotPresent
tag: ""
charts/spire/charts/spire-server/README.md
+2 -2
View File
@@ -341,8 +341,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `externalControllerManagers.defaults.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
| `externalControllerManagers.defaults.cacheNamespaces` | If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. | `{}` |
| `externalControllerManagers.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` |
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `tools.busybox.image.registry` | The OCI registry to pull the image from | `""` |
charts/spire/charts/spire-server/values.yaml
+2 -2
View File
@@ -825,8 +825,8 @@ tools:
## @param tools.kubectl.image.tag Overrides the image tag whose default is the chart appVersion
##
image:
registry: docker.io
repository: rancher/kubectl
registry: registry.k8s.io
repository: kubectl
pullPolicy: IfNotPresent
tag: ""
busybox: