Skip to content

[Enhancement]: Support image digest pinning in helm chart #11677

@Dual-0

Description

@Dual-0

What features would you like to see added?

I use FluxCD to track the latest image tag to ensure the absolute newest version is deployed immediately upon release.

Because latest is a mutable tag, I would like to use digest pinning (SHA256) to:

  1. Ensure Kubernetes pulls the new image content immediately (bypassing potential node caching of "latest").
  2. Maintain a precise, immutable history of exactly which version of "latest" is running in our GitOps repository.

Unfortunately the current Helm template enforces the format {{ .registry }}/{{ .repository }}:{{ .tag }}.

Would be nice if you can add an optional digest field

More details

Please add an optional digest field to values.yaml and update the deployment.yaml template to append the digest with the required @ separator if provided.

Proposed Implementation:

values.yaml

image:
  # ... existing fields ...
  digest: "" # Optional field for SHA256 pinning

deployment.yaml

# Updates the template to include the '@' separator when a digest is present
image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}{{ if .Values.image.digest }}@{{ .Values.image.digest }}{{ end }}"

Which components are impacted by your request?

Other

Pictures

No response

Code of Conduct

  • I agree to follow this project's Code of Conduct

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions