ACTION REQUIRED: Changes to pulling Chainguard Images

[chainguard-alerter]

Hey there Chainguard here.

We noticed that you are using Chainguard Images, thank you! We wanted to make you aware of an upcoming change that will impact your project.

Starting August 16, 2023 public users will no longer be able to pull images from our registry (cgr.dev/chainguard) by tags other than latest or latest-dev. Please see the announcement for more information.

You are currently using the following.

In https://github.com/spiffe/helm-charts/blob/a167ce68901a2b08d44367aa3a6da7612a64afc6/charts/spire/charts/tornjak-frontend/values.yaml:

• cgr.dev/chainguard/bash:5.2.15

In https://github.com/spiffe/helm-charts/blob/a167ce68901a2b08d44367aa3a6da7612a64afc6/charts/spire/charts/spire-server/values.yaml:

• cgr.dev/chainguard/bash:5.2.15

In https://github.com/spiffe/helm-charts/blob/a167ce68901a2b08d44367aa3a6da7612a64afc6/charts/spire/charts/spire-agent/values.yaml:

• cgr.dev/chainguard/wait-for-it:latest-20230517
• cgr.dev/chainguard/bash:5.2.15

In https://github.com/spiffe/helm-charts/blob/a167ce68901a2b08d44367aa3a6da7612a64afc6/charts/spire/charts/spire-agent/README.md:

• cgr.dev/chainguard/wait-for-it:latest-20230517
• cgr.dev/chainguard/bash:5.2.15

In https://github.com/spiffe/helm-charts/blob/a167ce68901a2b08d44367aa3a6da7612a64afc6/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml:

• cgr.dev/chainguard/bash:5.2.15

In https://github.com/spiffe/helm-charts/blob/a167ce68901a2b08d44367aa3a6da7612a64afc6/charts/spire/README.md:

• cgr.dev/chainguard/wait-for-it:latest-20230517
• cgr.dev/chainguard/bash:5.2.15

Our goal is to prevent your project from experiencing any disruptions. Please see the migration guide for options.

If there's more we can do to help please reply to this issue or email us at support@chainguard.dev.

Thank you!

[kfox1111]

So, we need to switch to :latest@sha256xxxxx on all these...

[kfox1111]

Renewing the call for #249

[faisal-memon]

Thanks chainguard. I think the digestabot mentioned in the migration guide would work well here.

[faisal-memon]

Discussed with @kfox1111 . digest-a-bot won't work for our use case as it assumes image and tag are together. For us they are separate configurables.

[amouat]

Hey, I work with Chainguard - I'm not sure what you mean by "separate configurables"? I'd love to come up with something that works for you if I can. Do you mean you need access to older tags?

[kfox1111]

@amouat Have a look at the values file here: https://github.com/spiffe/helm-charts/blob/main/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml#L18-L28

The registry, repository and tag properties are all independently defined/overridable. And there could be multiple image sections per values file. So I don't think there is an easy way to grep/sed through the file to detect/update the field like the digest-a-bot does.

I've got a pr here that can work with helm charts: https://github.com/spiffe/helm-charts/pull/249/files. Maybe some of that code would be useful to update things?

[amouat]

Ah cool, that is useful!

I was about to open an issue, but I see you already have! chainguard-dev/actions#295

I'd probably describe it as just "Helm Chart Support".