panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Switch image.version to image.tag

Browse Source 
The convention in most charts is to use image.tag. This patch updates the values
to use it instead of the less standard image.version.

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
Kevin Fox
2023-05-17 20:21:07 +02:00
committed by Marco Franssen
parent 31ce704fa8
commit d1f3cdb909
10 changed files with 36 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+10 -10
View File
@@ -129,7 +129,7 @@ Kubernetes: `>=1.21.0-0`
| spiffe-csi-driver.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spiffe-csi-driver.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| spiffe-csi-driver.image.repository | string | `"spiffe/spiffe-csi-driver"` | The repository within the registry |
| spiffe-csi-driver.image.version | string | `""` | Overrides the image tag whose default is the chart appVersion |
| spiffe-csi-driver.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion |
| spiffe-csi-driver.imagePullSecrets | list | `[]` | |
| spiffe-csi-driver.kubeletPath | string | `"/var/lib/kubelet"` | |
| spiffe-csi-driver.nameOverride | string | `""` | |
@@ -137,7 +137,7 @@ Kubernetes: `>=1.21.0-0`
| spiffe-csi-driver.nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spiffe-csi-driver.nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | The OCI registry to pull the image from |
| spiffe-csi-driver.nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | The repository within the registry |
| spiffe-csi-driver.nodeDriverRegistrar.image.version | string | `"v2.6.2"` | |
| spiffe-csi-driver.nodeDriverRegistrar.image.tag | string | `"v2.6.2"` | |
| spiffe-csi-driver.nodeDriverRegistrar.resources | object | `{}` | |
| spiffe-csi-driver.nodeSelector | object | `{}` | |
| spiffe-csi-driver.pluginName | string | `"csi.spiffe.io"` | Set the csi driver name deployed to Kubernetes. |
@@ -170,7 +170,7 @@ Kubernetes: `>=1.21.0-0`
| spiffe-oidc-discovery-provider.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spiffe-oidc-discovery-provider.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| spiffe-oidc-discovery-provider.image.repository | string | `"spiffe/oidc-discovery-provider"` | The repository within the registry |
| spiffe-oidc-discovery-provider.image.version | string | `""` | Overrides the image tag whose default is the chart appVersion |
| spiffe-oidc-discovery-provider.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion |
| spiffe-oidc-discovery-provider.imagePullSecrets | list | `[]` | |
| spiffe-oidc-discovery-provider.ingress.annotations | object | `{}` | |
| spiffe-oidc-discovery-provider.ingress.className | string | `""` | |
@@ -183,7 +183,7 @@ Kubernetes: `>=1.21.0-0`
| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` | The repository within the registry |
| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` | |
| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.tag | string | `"1.23.2-alpine"` | |
| spiffe-oidc-discovery-provider.insecureScheme.nginx.resources | object | `{}` | |
| spiffe-oidc-discovery-provider.nameOverride | string | `""` | |
| spiffe-oidc-discovery-provider.namespaceOverride | string | `""` | |
@@ -203,7 +203,7 @@ Kubernetes: `>=1.21.0-0`
| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | The repository within the registry |
| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.version | string | `"0.11.0"` | |
| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.tag | string | `"0.11.0"` | |
| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.resources | object | `{}` | |
| spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.enabled | bool | `false` | |
| spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.labels | object | `{}` | |
@@ -222,7 +222,7 @@ Kubernetes: `>=1.21.0-0`
| spire-agent.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spire-agent.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| spire-agent.image.repository | string | `"spiffe/spire-agent"` | The repository within the registry |
| spire-agent.image.version | string | `""` | |
| spire-agent.image.tag | string | `""` | |
| spire-agent.imagePullSecrets | list | `[]` | |
| spire-agent.initContainers | list | `[]` | |
| spire-agent.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
@@ -252,7 +252,7 @@ Kubernetes: `>=1.21.0-0`
| spire-agent.waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spire-agent.waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
| spire-agent.waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry |
| spire-agent.waitForIt.image.version | string | `"latest-20230113"` | |
| spire-agent.waitForIt.image.tag | string | `"latest-20230113"` | |
| spire-agent.waitForIt.resources | object | `{}` | |
| spire-agent.workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
| spire-agent.workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
@@ -283,7 +283,7 @@ Kubernetes: `>=1.21.0-0`
| spire-server.controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spire-server.controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| spire-server.controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry |
| spire-server.controllerManager.image.version | string | `"0.2.2"` | |
| spire-server.controllerManager.image.tag | string | `"0.2.2"` | |
| spire-server.controllerManager.resources | object | `{}` | |
| spire-server.controllerManager.securityContext | object | `{}` | |
| spire-server.controllerManager.service.annotations | object | `{}` | |
@@ -293,7 +293,7 @@ Kubernetes: `>=1.21.0-0`
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"rancher/kubectl"` | The repository within the registry |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `""` | |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.tag | string | `"latest"` | |
| spire-server.dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
| spire-server.dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
| spire-server.dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
@@ -314,7 +314,7 @@ Kubernetes: `>=1.21.0-0`
| spire-server.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spire-server.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| spire-server.image.repository | string | `"spiffe/spire-server"` | The repository within the registry |
| spire-server.image.version | string | `""` | Overrides the image tag whose default is the chart appVersion. |
| spire-server.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
| spire-server.imagePullSecrets | list | `[]` | |
| spire-server.initContainers | list | `[]` | |
| spire-server.jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain |
charts/spire/charts/spiffe-csi-driver/README.md
+2 -2
View File
@@ -19,7 +19,7 @@ A Helm chart to install the SPIFFE CSI driver.
| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| image.repository | string | `"spiffe/spiffe-csi-driver"` | The repository within the registry |
| image.version | string | `""` | Overrides the image tag whose default is the chart appVersion |
| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion |
| imagePullSecrets | list | `[]` | |
| kubeletPath | string | `"/var/lib/kubelet"` | |
| nameOverride | string | `""` | |
@@ -27,7 +27,7 @@ A Helm chart to install the SPIFFE CSI driver.
| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | The OCI registry to pull the image from |
| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | The repository within the registry |
| nodeDriverRegistrar.image.version | string | `"v2.6.2"` | |
| nodeDriverRegistrar.image.tag | string | `"v2.6.2"` | |
| nodeDriverRegistrar.resources | object | `{}` | |
| nodeSelector | object | `{}` | |
| pluginName | string | `"csi.spiffe.io"` | Set the csi driver name deployed to Kubernetes. |
charts/spire/charts/spiffe-csi-driver/values.yaml
+2 -2
View File
@@ -9,7 +9,7 @@ image:
# -- The image pull policy
pullPolicy: IfNotPresent
# -- Overrides the image tag whose default is the chart appVersion
version: ""
tag: ""
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
@@ -63,7 +63,7 @@ nodeDriverRegistrar:
repository: sig-storage/csi-node-driver-registrar
# -- The image pull policy
pullPolicy: IfNotPresent
version: v2.6.2
tag: v2.6.2
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+3 -3
View File
@@ -34,7 +34,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| image.repository | string | `"spiffe/oidc-discovery-provider"` | The repository within the registry |
| image.version | string | `""` | Overrides the image tag whose default is the chart appVersion |
| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion |
| imagePullSecrets | list | `[]` | |
| ingress.annotations | object | `{}` | |
| ingress.className | string | `""` | |
@@ -47,7 +47,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| insecureScheme.nginx.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
| insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` | The repository within the registry |
| insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` | |
| insecureScheme.nginx.image.tag | string | `"1.23.2-alpine"` | |
| insecureScheme.nginx.resources | object | `{}` | |
| nameOverride | string | `""` | |
| namespaceOverride | string | `""` | |
@@ -67,7 +67,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| telemetry.prometheus.nginxExporter.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| telemetry.prometheus.nginxExporter.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
| telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | The repository within the registry |
| telemetry.prometheus.nginxExporter.image.version | string | `"0.11.0"` | |
| telemetry.prometheus.nginxExporter.image.tag | string | `"0.11.0"` | |
| telemetry.prometheus.nginxExporter.resources | object | `{}` | |
| telemetry.prometheus.podMonitor.enabled | bool | `false` | |
| telemetry.prometheus.podMonitor.labels | object | `{}` | |
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+4 -4
View File
@@ -17,7 +17,7 @@ image:
# -- The image pull policy
pullPolicy: IfNotPresent
# -- Overrides the image tag whose default is the chart appVersion
version: ""
tag: ""
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
@@ -65,13 +65,13 @@ insecureScheme:
repository: nginxinc/nginx-unprivileged
# -- The image pull policy
pullPolicy: IfNotPresent
version: 1.23.2-alpine
tag: 1.23.2-alpine
# chainguard image does not support the templates feature
# https://github.com/chainguard-images/nginx/issues/43
# registry: cgr.dev
# repository: chainguard/nginx
# pullPolicy: IfNotPresent
# version: "1.23.2"
# tag: "1.23.2"
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
@@ -146,7 +146,7 @@ telemetry:
repository: nginx/nginx-prometheus-exporter
# -- The image pull policy
pullPolicy: IfNotPresent
version: "0.11.0"
tag: "0.11.0"
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
charts/spire/charts/spire-agent/README.md
+2 -2
View File
@@ -25,7 +25,7 @@ A Helm chart to install the SPIRE agent.
| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| image.repository | string | `"spiffe/spire-agent"` | The repository within the registry |
| image.version | string | `""` | |
| image.tag | string | `""` | |
| imagePullSecrets | list | `[]` | |
| initContainers | list | `[]` | |
| logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
@@ -55,7 +55,7 @@ A Helm chart to install the SPIRE agent.
| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry |
| waitForIt.image.version | string | `"latest-20230113"` | |
| waitForIt.image.tag | string | `"latest-20230113"` | |
| waitForIt.resources | object | `{}` | |
| workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
| workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
charts/spire/charts/spire-agent/values.yaml
+2 -2
View File
@@ -10,7 +10,7 @@ image:
# -- The image pull policy
pullPolicy: IfNotPresent
# Overrides the image tag whose default is the chart appVersion.
version: ""
tag: ""
imagePullSecrets: []
nameOverride: ""
@@ -86,7 +86,7 @@ waitForIt:
repository: chainguard/wait-for-it
# -- The image pull policy
pullPolicy: IfNotPresent
version: latest-20230113
tag: latest-20230113
resources: {}
# workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
charts/spire/charts/spire-server/README.md
+3 -3
View File
@@ -44,7 +44,7 @@ A Helm chart to install the SPIRE server.
| controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry |
| controllerManager.image.version | string | `"0.2.2"` | |
| controllerManager.image.tag | string | `"0.2.2"` | |
| controllerManager.resources | object | `{}` | |
| controllerManager.securityContext | object | `{}` | |
| controllerManager.service.annotations | object | `{}` | |
@@ -54,7 +54,7 @@ A Helm chart to install the SPIRE server.
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"rancher/kubectl"` | The repository within the registry |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `""` | |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.tag | string | `"latest"` | |
| dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
| dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
| dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
@@ -75,7 +75,7 @@ A Helm chart to install the SPIRE server.
| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| image.repository | string | `"spiffe/spire-server"` | The repository within the registry |
| image.version | string | `""` | Overrides the image tag whose default is the chart appVersion. |
| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
| imagePullSecrets | list | `[]` | |
| initContainers | list | `[]` | |
| jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain |
charts/spire/charts/spire-server/values.yaml
+3 -3
View File
@@ -13,7 +13,7 @@ image:
# -- The image pull policy
pullPolicy: IfNotPresent
# -- Overrides the image tag whose default is the chart appVersion.
version: ""
tag: ""
imagePullSecrets: []
nameOverride: ""
@@ -170,7 +170,7 @@ controllerManager:
# -- The image pull policy
pullPolicy: IfNotPresent
# Overrides the image tag whose default is the chart appVersion.
version: "0.2.2"
tag: "0.2.2"
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
@@ -229,7 +229,7 @@ controllerManager:
repository: rancher/kubectl
# -- The image pull policy
pullPolicy: IfNotPresent
version: ""
tag: latest
telemetry:
prometheus:
charts/spire/templates/_spire-lib.tpl
+5 -5
View File
@@ -40,12 +40,12 @@
{{- define "spire-lib.image" -}}
{{- $registry := include "spire-lib.registry" . }}
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
{{- printf "%s/%s@%s" $registry .image.repository .image.version -}}
{{- if eq (substr 0 7 .image.tag) "sha256:" -}}
{{- printf "%s/%s@%s" $registry .image.repository .image.tag -}}
{{- else if .appVersion -}}
{{- printf "%s/%s:%s" $registry .image.repository (default .appVersion .image.version) -}}
{{- else if .image.version -}}
{{- printf "%s/%s:%s" $registry .image.repository .image.version -}}
{{- printf "%s/%s:%s" $registry .image.repository (default .appVersion .image.tag) -}}
{{- else if .image.tag -}}
{{- printf "%s/%s:%s" $registry .image.repository .image.tag -}}
{{- else -}}
{{- printf "%s/%s" $registry .image.repository -}}
{{- end -}}