From 61c093a3277aa3c343426e33aa034f038dd0877c Mon Sep 17 00:00:00 2001 From: Alan Cha Date: Mon, 3 Aug 2026 13:26:13 -0400 Subject: [PATCH 1/2] fix: use upstream ghcr.io/spiffe/spiffe-helper image for operator sidecar The operator's own spiffe-helper sidecar (injected into rossoctl-controller-manager when spiffe.operatorAuth.enabled=true) pointed at ghcr.io/rossoctl/cortex/spiffe-helper:latest, which was never published (403 Forbidden on pull) -- the operator pod gets stuck at 1/2 Ready and never obtains a JWT-SVID, so operator SPIFFE auth never actually authenticates at runtime even though the bootstrap Job successfully registers the Keycloak client. The container's CLI args (-config /etc/spiffe-helper/config.hcl) match the real upstream SPIFFE project tool exactly, and an earlier branch already used ghcr.io/spiffe/spiffe-helper:0.11.0 before this regressed to the broken rossoctl/cortex path. Point it back at the real upstream image. Assisted-By: Claude (Anthropic AI) Signed-off-by: Alan Cha --- charts/operator/templates/manager/manager.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/operator/templates/manager/manager.yaml b/charts/operator/templates/manager/manager.yaml index 600320a7..59fa68bf 100644 --- a/charts/operator/templates/manager/manager.yaml +++ b/charts/operator/templates/manager/manager.yaml @@ -193,7 +193,7 @@ spec: {{- end }} {{- if and .Values.spiffe .Values.spiffe.enabled .Values.spiffe.operatorAuth .Values.spiffe.operatorAuth.enabled }} - name: spiffe-helper - image: ghcr.io/rossoctl/cortex/spiffe-helper:latest + image: ghcr.io/spiffe/spiffe-helper:latest imagePullPolicy: IfNotPresent args: - "-config" From 9fd0a4480979992bb621018ab29eba5b310ee41b Mon Sep 17 00:00:00 2001 From: Alan Cha Date: Mon, 3 Aug 2026 17:01:55 -0400 Subject: [PATCH 2/2] fix: pin spiffe-helper to v0.11.0 instead of :latest Unlike authbridge/envoyProxy/authbridgeLite/proxyInit (rossoctl-built images that default to :latest at the chart level and get pinned by the downstream rossoctl/rossoctl consumer chart), spiffe-helper is a genuine third-party upstream dependency with no downstream pin step for it. Tag it directly to the current latest stable release (ghcr.io/spiffe/spiffe-helper:0.11.0, confirmed to exist via docker manifest inspect) rather than tracking :latest. Assisted-By: Claude (Anthropic AI) Signed-off-by: Alan Cha --- charts/operator/templates/manager/manager.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/operator/templates/manager/manager.yaml b/charts/operator/templates/manager/manager.yaml index 59fa68bf..ae832633 100644 --- a/charts/operator/templates/manager/manager.yaml +++ b/charts/operator/templates/manager/manager.yaml @@ -193,7 +193,7 @@ spec: {{- end }} {{- if and .Values.spiffe .Values.spiffe.enabled .Values.spiffe.operatorAuth .Values.spiffe.operatorAuth.enabled }} - name: spiffe-helper - image: ghcr.io/spiffe/spiffe-helper:latest + image: ghcr.io/spiffe/spiffe-helper:0.11.0 imagePullPolicy: IfNotPresent args: - "-config"