chore: bump socket-firewall chart and image versions

[getsantry]

Automated weekly version check found newer releases.

Updates

• helm_chart_version: 0.3.1 → 0.4.1
• firewall_image_tag: 1.1.328 → 1.1.335

Follow-up

• Review the terraform plan check on this PR.
• Confirm the new image is allowed by Binary Authorization before merging to main.

Triggered by check-firewall-versions.

[github-actions]

Terraform plan in terraform

Plan: 0 to add, 1 to change, 0 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place
 <= read (data resources)

Terraform will perform the following actions:

  # data.kubernetes_service.socket_firewall will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "kubernetes_service" "socket_firewall" {
+       id     = (known after apply)
+       spec   = (known after apply)
+       status = (known after apply)

+       metadata {
+           generation       = (known after apply)
+           name             = "socket-firewall"
+           namespace        = "socket-firewall"
+           resource_version = (known after apply)
+           uid              = (known after apply)
        }
    }

  # helm_release.socket_firewall will be updated in-place
!~  resource "helm_release" "socket_firewall" {
        id                         = "socket-firewall"
!~      metadata                   = [
-           {
-               app_version    = "1.1.328"
-               chart          = "socket-firewall"
-               first_deployed = 1781303659
-               last_deployed  = 1781733644
-               name           = "socket-firewall"
-               namespace      = "socket-firewall"
-               notes          = <<-EOT
                    Socket Firewall deployed successfully!
                    
                    ## Self-Signed Certificates
                    
                    Self-signed certificates were generated. Extract the CA certificate:
                    
                      kubectl exec -n socket-firewall \
                        $(kubectl get pod -n socket-firewall -l app.kubernetes.io/name=socket-firewall -o jsonpath='{.items[0].metadata.name}') \
                        -- cat /etc/nginx/ssl/ca.crt > socket-ca.crt
                    
                    Then trust the CA on developer machines or use a real certificate for production.
                    
                    ## Accessing the Firewall
                    For testing, use port-forward:
                    
                      kubectl port-forward svc/socket-firewall 8443:443 -n socket-firewall
                    
                    For production, expose via Ingress or change service.type to LoadBalancer.
                    
                    ## Usage
                    
                    Path-based routing is enabled on domain: sfw.security.sentry.io
                    
                    Configure package managers to use path prefixes:
                      npm: https://sfw.security.sentry.io/npm/
                      pypi: https://sfw.security.sentry.io/pypi/
                      maven: https://sfw.security.sentry.io/maven/
                    
                    Example:
                      npm config set registry https://sfw.security.sentry.io/npm/
                      pip config set global.index-url https://sfw.security.sentry.io/pypi/simple
                    
                    ## Verify
                    
                    Test the health endpoint:
                    
                      curl -sk https://<firewall-ip>/health
                    
                    See deployment recommendations in README.md for production setup.
                EOT
-               revision       = 9
-               values         = jsonencode(
                    {
-                       affinity           = {
-                           podAntiAffinity = {
-                               preferredDuringSchedulingIgnoredDuringExecution = [
-                                   {
-                                       podAffinityTerm = {
-                                           labelSelector = {
-                                               matchLabels = {
-                                                   "app.kubernetes.io/instance" = "socket-firewall"
                                                }
                                            }
-                                           topologyKey   = "kubernetes.io/hostname"
                                        }
-                                       weight          = 100
                                    },
                                ]
                            }
                        }
-                       autoscaling        = {
-                           enabled = true
                        }
-                       image              = {
-                           pullPolicy = "IfNotPresent"
-                           repository = "socketdev/socket-registry-firewall"
-                           tag        = "1.1.328"
                        }
-                       initContainers     = {
-                           certGenerator = {
-                               securityContext = {
-                                   allowPrivilegeEscalation = false
-                                   capabilities             = {
-                                       drop = [
-                                           "ALL",
                                        ]
                                    }
-                                   readOnlyRootFilesystem   = true
-                                   runAsNonRoot             = true
-                                   runAsUser                = 1001
-                                   seccompProfile           = {
-                                       type = "RuntimeDefault"
                                    }
                                }
                            }
                        }
-                       pathRouting        = {
-                           domain  = "sfw.security.sentry.io"
-                           enabled = true
-                           routes  = [
-                               {
-                                   path     = "/npm"
-                                   registry = "npm"
-                                   upstream = "https://registry.npmjs.org"
                                },
-                               {
-                                   path     = "/pypi"
-                                   registry = "pypi"
-                                   upstream = "https://pypi.org"
                                },
-                               {
-                                   path     = "/maven"
-                                   registry = "maven"
-                                   upstream = "https://repo1.maven.org/maven2"
                                },
                            ]
                        }
-                       podSecurityContext = {
-                           fsGroup = 1001
                        }
-                       replicaCount       = 2
-                       resources          = {
-                           limits   = {
-                               cpu    = "1"
-                               memory = "768Mi"
                            }
-                           requests = {
-                               cpu    = "500m"
-                               memory = "512Mi"
                            }
                        }
-                       service            = {
-                           httpsTargetPort = "http"
-                           type            = "ClusterIP"
                        }
-                       socket             = {
-                           existingSecret    = "socket-api-token"
-                           existingSecretKey = "SOCKET_SECURITY_API_TOKEN"
-                           failOpen          = false
-                           failOpenUnscanned = false
                        }
-                       tls                = {
-                           generateSelfSigned = true
                        }
                    }
                )
-               version        = "0.3.1"
            },
        ] -> (known after apply)
        name                       = "socket-firewall"
!~      values                     = [
!~          <<-EOT
                "affinity":
                  "podAntiAffinity":
                    "preferredDuringSchedulingIgnoredDuringExecution":
                    - "podAffinityTerm":
                        "labelSelector":
                          "matchLabels":
                            "app.kubernetes.io/instance": "socket-firewall"
                        "topologyKey": "kubernetes.io/hostname"
                      "weight": 100
                "autoscaling":
                  "enabled": true
                "image":
                  "pullPolicy": "IfNotPresent"
                  "repository": "socketdev/socket-registry-firewall"
              -   "tag": "1.1.328"
              +   "tag": "1.1.335"
                "initContainers":
                  "certGenerator":
                    "securityContext":
                      "allowPrivilegeEscalation": false
                      "capabilities":
                        "drop":
                        - "ALL"
                      "readOnlyRootFilesystem": true
                      "runAsNonRoot": true
                      "runAsUser": 1001
                      "seccompProfile":
                        "type": "RuntimeDefault"
                "pathRouting":
                  "domain": "sfw.security.sentry.io"
                  "enabled": true
                  "routes":
                  - "path": "/npm"
                    "registry": "npm"
                    "upstream": "https://registry.npmjs.org"
                  - "path": "/pypi"
                    "registry": "pypi"
                    "upstream": "https://pypi.org"
                  - "path": "/maven"
                    "registry": "maven"
                    "upstream": "https://repo1.maven.org/maven2"
                "podSecurityContext":
                  "fsGroup": 1001
                "replicaCount": 2
                "resources":
                  "limits":
                    "cpu": "1"
                    "memory": "768Mi"
                  "requests":
                    "cpu": "500m"
                    "memory": "512Mi"
                "service":
                  "httpsTargetPort": "http"
                  "type": "ClusterIP"
                "socket":
                  "existingSecret": "socket-api-token"
                  "existingSecretKey": "SOCKET_SECURITY_API_TOKEN"
                  "failOpen": false
                  "failOpenUnscanned": false
                "tls":
                  "generateSelfSigned": true
            EOT,
        ]
!~      version                    = "0.3.1" -> "0.4.1"
#        (25 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

✅ Plan applied in Terraform Apply #15

Outputs

cluster_name                 = "socket-firewall"
firewall_domain              = "sfw.security.sentry.io"
firewall_health_url          = "https://sfw.security.sentry.io/health"
firewall_load_balancer_ip    = "34.98.104.179"
firewall_namespace           = "socket-firewall"
firewall_service_name        = "socket-firewall"
kubeconfig_command           = "gcloud container fleet memberships get-credentials socket-firewall --project sentry-socket"
tls_certificate_name         = "socket-firewall-cert"
tls_dns_authorization_record = {
    data = "6a407a91-86a0-4dc8-a434-e72cdc012e0e.9.authorize.certificatemanager.goog."
    name = "_acme-challenge.sfw.security.sentry.io."
    type = "CNAME"
}