feat: add optional image.digest for content-addressed image pinning - #480
Open
Nofar-Sin wants to merge 2 commits into
Open
feat: add optional image.digest for content-addressed image pinning#480Nofar-Sin wants to merge 2 commits into
Nofar-Sin wants to merge 2 commits into
Conversation
added 2 commits
July 8, 2026 18:44
…inning Pinning the qdrant image by digest is currently impossible via values: the tag@sha256 form breaks the semverCompare readiness-path check in statefulset.yaml, and there is no digest field. Add an optional image.digest that is appended to the image reference (repo:tag@digest) for both the init and main containers, keeping image.tag a plain semver so existing version logic is untouched. No behavior change when unset.
Nofar-Sin
marked this pull request as ready for review
July 8, 2026 15:49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Pinning the qdrant image by digest is currently impossible through values. The natural attempt —
— fails at template time, because
statefulset.yamlrunssemverCompareonimage.tagto pick the readiness path (/readyzvs/), and the digest suffix is not a valid semver:Digest pinning is required by supply-chain hardening baselines (tag-only pulls resolve at pull time and are not reproducible), so charts that validate the tag need a separate digest field.
Change
Add an optional
image.digest(default"", no behavior change when unset). When set, it is appended to the image reference for both the init container and the main container:image.tagstays a plain semver, so the existingsemverComparereadiness logic is untouched. In atag@digestreference the runtime resolves by digest; the tag remains informational.Documented caveat in values.yaml: with
useUnprivilegedImage: truethe digest must be the-unprivilegedvariant's digest.Testing
helm lintcleanmake test-unit(terratest suite) passesuseUnprivilegedImageChart version bumped to 1.18.3 + CHANGELOG entry — happy to adjust if you version differently.