Pin chart image refs for supply-chain security

Author: eapache-opslevel

charts/gitlab-proxy/values.yaml

@@ -1,4 +1,4 @@
-image: "caddy:2.6"
+image: "caddy:2.6@sha256:60fb54d36b4b56b655fbcea432b0057ecc24f68d3a9ff800c695886be48e368d"
 real_token: ""
 dummy_token: ""
 gitlab_domain: "https://gitlab.com"

charts/kubernetes-sync/values.yaml

@@ -3,7 +3,7 @@ apitokenPath:
 apitokenSecret:
   name: opslevel-api-token
 
-image: public.ecr.aws/opslevel/kubectl-opslevel:v2024.9.5
+image: public.ecr.aws/opslevel/kubectl-opslevel:v2024.9.5@sha256:71697b5ff7139f603bc445a429c3fb34d538b2abca8efb7d1a2535fc0653a213
 
 sync:
   args:

charts/opslevel-agent/templates/_helpers.tpl

@@ -1,3 +1,3 @@
 {{- define "agent.image" -}}
-{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag }}
+{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag }}{{- if .Values.agent.image.digest }}@{{ .Values.agent.image.digest }}{{- end }}
 {{- end }}

charts/opslevel-agent/values.yaml

@@ -78,6 +78,7 @@ agent:
   image:
     repository: "public.ecr.aws/opslevel/opslevel-agent"
     tag: "v2025.8.29"
+    digest: "sha256:0835f3fee44144a5b03e79e3ba996d9bf21f548daf03294c9b50ebc63fe8e911"
   integration: "kubernetes"
   labels: {}
   annotations: {}

charts/opslevel/templates/_helpers.tpl

@@ -80,11 +80,11 @@ https://github.com/apps/{{ required "please provide 'integrations.github.secret.
 {{- end }}
 
 {{- define "objectStorageCLI.image" -}}
-{{ .Values.objectStorage.image.repositoryCLI }}:{{ .Values.objectStorage.image.tagCLI }}
+{{ .Values.objectStorage.image.repositoryCLI }}:{{ .Values.objectStorage.image.tagCLI }}{{- if .Values.objectStorage.image.digestCLI }}@{{ .Values.objectStorage.image.digestCLI }}{{- end }}
 {{- end }}
 
 {{- define "runner.image" -}}
-{{ .Values.runner.image.repository }}:{{ .Values.runner.image.tag }}
+{{ .Values.runner.image.repository }}:{{ .Values.runner.image.tag }}{{- if .Values.runner.image.digest }}@{{ .Values.runner.image.digest }}{{- end }}
 {{- end }}
 
 {{- define "faktory.image" -}}

charts/opslevel/values.yaml

@@ -92,6 +92,7 @@ runner:
   image:
     repository: "public.ecr.aws/opslevel/opslevel-runner"
     tag: "v2025.8.11"
+    digest: "sha256:048597926fffe2af850e607c509fc396fc73fa7bf46594c2f9b2fcbb452bfdab"
   job_image:
     repository: "public.ecr.aws/opslevel"
   replicas: 3
@@ -259,6 +260,7 @@ objectStorage:
     tag: "RELEASE.2022-08-22T23-53-06Z"
     repositoryCLI: "minio/mc"
     tagCLI: "RELEASE.2023-02-28T00-12-59Z"
+    digestCLI: "sha256:c631532a394eb0e2c54cfc6f28a98c4d261924f17886763ee45c786c32c9f4a1"
   resources: *resourcesMedium
   pod:
     annotations: {}