add digests for all private OpsLevel images to harden supply chain

Author: derek-etherton-opslevel

charts/opslevel/templates/_helpers.tpl

@@ -52,31 +52,31 @@ https://github.com/apps/{{ required "please provide 'integrations.github.secret.
 {{- end }}
 
 {{- define "opslevel.image" -}}
-{{ .Values.global.proxy }}{{if .Values.global.proxy }}/{{ end }}{{ .Values.opslevel.image.repository }}:{{ .Values.opslevel.image.tag }}
+{{ .Values.global.proxy }}{{if .Values.global.proxy }}/{{ end }}{{ .Values.opslevel.image.repository }}:{{ .Values.opslevel.image.tag }}{{- if .Values.opslevel.image.digest }}@{{ .Values.opslevel.image.digest }}{{- end }}
 {{- end }}
 
 {{- define "opssight.image" -}}
-{{ .Values.global.proxy }}{{if .Values.global.proxy }}/{{ end }}{{ .Values.opssight.image.repository }}:{{ .Values.opssight.image.tag }}
+{{ .Values.global.proxy }}{{if .Values.global.proxy }}/{{ end }}{{ .Values.opssight.image.repository }}:{{ .Values.opssight.image.tag }}{{- if .Values.opssight.image.digest }}@{{ .Values.opssight.image.digest }}{{- end }}
 {{- end }}
 
 {{- define "mysql.image" -}}
-{{ .Values.global.proxy }}{{if .Values.global.proxy }}/{{ end }}{{ .Values.mysql.image.repository }}:{{ .Values.mysql.image.tag }}
+{{ .Values.global.proxy }}{{if .Values.global.proxy }}/{{ end }}{{ .Values.mysql.image.repository }}:{{ .Values.mysql.image.tag }}{{- if .Values.mysql.image.digest }}@{{ .Values.mysql.image.digest }}{{- end }}
 {{- end }}
 
 {{- define "redis.image" -}}
-{{ .Values.global.proxy }}{{if .Values.global.proxy }}/{{ end }}{{ .Values.redis.image.repository }}:{{ .Values.redis.image.tag }}
+{{ .Values.global.proxy }}{{if .Values.global.proxy }}/{{ end }}{{ .Values.redis.image.repository }}:{{ .Values.redis.image.tag }}{{- if .Values.redis.image.digest }}@{{ .Values.redis.image.digest }}{{- end }}
 {{- end }}
 
 {{- define "postgres.image" -}}
-{{ .Values.global.proxy }}{{if .Values.global.proxy }}/{{ end }}{{ .Values.postgres.image.repository }}:{{ .Values.postgres.image.tag }}
+{{ .Values.global.proxy }}{{if .Values.global.proxy }}/{{ end }}{{ .Values.postgres.image.repository }}:{{ .Values.postgres.image.tag }}{{- if .Values.postgres.image.digest }}@{{ .Values.postgres.image.digest }}{{- end }}
 {{- end }}
 
 {{- define "elasticsearch.image" -}}
-{{ .Values.global.proxy }}{{if .Values.global.proxy }}/{{ end }}{{ .Values.elasticsearch.image.repository }}:{{ .Values.elasticsearch.image.tag }}
+{{ .Values.global.proxy }}{{if .Values.global.proxy }}/{{ end }}{{ .Values.elasticsearch.image.repository }}:{{ .Values.elasticsearch.image.tag }}{{- if .Values.elasticsearch.image.digest }}@{{ .Values.elasticsearch.image.digest }}{{- end }}
 {{- end }}
 
 {{- define "objectStorage.image" -}}
-{{ .Values.global.proxy }}{{if .Values.global.proxy }}/{{ end }}{{ .Values.objectStorage.image.repository }}:{{ .Values.objectStorage.image.tag }}
+{{ .Values.global.proxy }}{{if .Values.global.proxy }}/{{ end }}{{ .Values.objectStorage.image.repository }}:{{ .Values.objectStorage.image.tag }}{{- if .Values.objectStorage.image.digest }}@{{ .Values.objectStorage.image.digest }}{{- end }}
 {{- end }}
 
 {{- define "objectStorageCLI.image" -}}
@@ -88,7 +88,7 @@ https://github.com/apps/{{ required "please provide 'integrations.github.secret.
 {{- end }}
 
 {{- define "faktory.image" -}}
-{{ .Values.global.proxy }}{{if .Values.global.proxy }}/{{ end }}{{ .Values.faktory.image.repository }}:{{ .Values.faktory.image.tag }}
+{{ .Values.global.proxy }}{{if .Values.global.proxy }}/{{ end }}{{ .Values.faktory.image.repository }}:{{ .Values.faktory.image.tag }}{{- if .Values.faktory.image.digest }}@{{ .Values.faktory.image.digest }}{{- end }}
 {{- end }}
 
 {{- define "faktory.url" -}}

charts/opslevel/values.yaml

@@ -40,6 +40,7 @@ opslevel:
   image:
     repository: "746108190720.dkr.ecr.us-east-1.amazonaws.com/opslevel"
     tag: "selfhosted-prod-df09c051-1770400830"
+    digest: "sha256:38f321a345bd780a94dc87647a13fd7fecae1cda29cfa5b8bc6a197ed39fff42"
   account:
     name: "Main"
     username: "Alice Wonderland"
@@ -125,6 +126,7 @@ opssight:
   image:
     repository: "746108190720.dkr.ecr.us-east-1.amazonaws.com/opssight"
     tag: "selfhosted-production-c8726ff-1770403220"
+    digest: "sha256:8a3f5530957257530785304155bb769d6ee22e8378d674e8f806b93a79f84764"
   pod:
     annotations: {}
   web:
@@ -144,6 +146,7 @@ mysql:
   image:
     repository: "746108190720.dkr.ecr.us-east-1.amazonaws.com/mysql"
     tag: "8.0.34-debian"
+    digest: "sha256:be872f0d857262b512e094dd399ff7abd02cb93a73d0df1317decd1ea23b9391"
   resources: *resourcesMedium
   pod:
     annotations: {}
@@ -168,6 +171,7 @@ postgres:
   image:
     repository: "746108190720.dkr.ecr.us-east-1.amazonaws.com/postgres"
     tag: "16.1-bookworm"
+    digest: "sha256:6984ec6ca4fa95a2728bd2036b6536f5092b327fcc18e052e321fd7e12308b23"
   resources: *resourcesMedium
   pod:
     annotations: {}
@@ -193,6 +197,7 @@ redis:
   image:
     repository: "746108190720.dkr.ecr.us-east-1.amazonaws.com/redis"
     tag: "6.2.6"
+    digest: "sha256:226cbafc637cd58cf008bf87ec9d1548ad1b672ef4279433495bdff100cdb883"
   resources: *resourcesMedium
   pod:
     annotations: {}
@@ -232,6 +237,7 @@ elasticsearch:
   image:
     repository: "746108190720.dkr.ecr.us-east-1.amazonaws.com/elasticsearch"
     tag: "8.17.3"
+    digest: "sha256:b5b1b63e263e5ebbbe9dc168ff3ce3024f28578f493e5571a3f008eae52940a9"
   resources: *resourcesLarge
   pod:
     annotations: {}
@@ -257,6 +263,7 @@ objectStorage:
   image:
     repository: "746108190720.dkr.ecr.us-east-1.amazonaws.com/minio"
     tag: "RELEASE.2022-08-22T23-53-06Z"
+    digest: "sha256:255ead3d1a52c268e4a97428a827e9c50912ec2a03970432f9d6bcc5d69066df"
     repositoryCLI: "minio/mc"
     tagCLI: "RELEASE.2023-02-28T00-12-59Z"
   resources: *resourcesMedium
@@ -281,6 +288,7 @@ faktory:
   image:
     repository: "746108190720.dkr.ecr.us-east-1.amazonaws.com/faktory"
     tag: "1.9.1"
+    digest: "sha256:0139f895e97aa961b4e7dce3050e768c352e4a67c14c64e67ade4ca0bb71790a"
   resources: *resourcesMedium
   securityContext: {}
   storageClass: ""