fix(charts): restore spiffeHelper.image values block with latest as default

Hardcoding :latest in the template was worse — it removed the ability to
override the image via Helm values without forking the chart. Restore the
templated approach with tag: latest as the default, which is the only
reliably-published tag.

Signed-off-by: Alan Cha <alan.cha@ibm.com>
Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Alan Cha <Alan.cha1@ibm.com>

Author: Alan-Cha

charts/kagenti-operator/templates/manager/manager.yaml

@@ -193,8 +193,8 @@ spec:
             {{- end }}
         {{- if and .Values.spiffe .Values.spiffe.enabled .Values.spiffe.operatorAuth .Values.spiffe.operatorAuth.enabled }}
         - name: spiffe-helper
-          image: ghcr.io/kagenti/kagenti-extensions/spiffe-helper:latest
-          imagePullPolicy: IfNotPresent
+          image: {{ .Values.spiffe.operatorAuth.spiffeHelper.image.repository | default "ghcr.io/kagenti/kagenti-extensions/spiffe-helper" }}:{{ .Values.spiffe.operatorAuth.spiffeHelper.image.tag | default "latest" }}
+          imagePullPolicy: {{ .Values.spiffe.operatorAuth.spiffeHelper.image.pullPolicy | default "IfNotPresent" }}
           args:
             - "-config"
             - "/etc/spiffe-helper/config.hcl"

charts/kagenti-operator/values.yaml

@@ -207,6 +207,11 @@ spiffe:
     enabled: false
     # Path to JWT-SVID file written by spiffe-helper sidecar
     jwtSVIDPath: "/opt/jwt_svid.token"
+    spiffeHelper:
+      image:
+        repository: ghcr.io/kagenti/kagenti-extensions/spiffe-helper
+        tag: latest
+        pullPolicy: IfNotPresent
 
 # Feature gates — highest-priority layer in the injection precedence chain.
 # Set globalEnabled to false to disable ALL sidecar injection (kill switch).