From 8b2a705d3e22dedb1ebb0279cd35bd170d6629c6 Mon Sep 17 00:00:00 2001 From: Josip Rodin Date: Mon, 21 Sep 2026 10:47:06 +0200 Subject: [PATCH] feat(sealed-secrets): use Docker Hardened Images We keep the chart as is, just override the image to use our DHI mirror, with the version bumped to the latest (includes helm-docs.sh output) --- charts/gitops-runtime/Chart.yaml | 2 +- charts/gitops-runtime/README.md | 2 +- charts/gitops-runtime/values.yaml | 7 ++++--- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/charts/gitops-runtime/Chart.yaml b/charts/gitops-runtime/Chart.yaml index 04273f2d..c66f47c7 100644 --- a/charts/gitops-runtime/Chart.yaml +++ b/charts/gitops-runtime/Chart.yaml @@ -26,7 +26,7 @@ dependencies: condition: argo-workflows.enabled - name: sealed-secrets repository: https://bitnami.github.io/sealed-secrets - version: 2.18.0 + version: 2.18.6 condition: sealed-secrets.enabled - name: codefresh-tunnel-client repository: oci://quay.io/codefresh/charts diff --git a/charts/gitops-runtime/README.md b/charts/gitops-runtime/README.md index ba96dfb9..1f791a2a 100644 --- a/charts/gitops-runtime/README.md +++ b/charts/gitops-runtime/README.md @@ -813,7 +813,7 @@ global: | redis.readinessProbe | object | `{"enabled":true,"failureThreshold":5,"initialDelaySeconds":30,"periodSeconds":15,"successThreshold":1,"timeoutSeconds":15}` | Probes configuration | | redis.service | object | `{"annotations":{},"labels":{},"ports":{"metrics":{"port":9121,"targetPort":9121},"redis":{"port":6379,"targetPort":6379}},"type":"ClusterIP"}` | Service configuration | | redis.serviceAccount | object | `{"annotations":{},"create":true,"name":""}` | Create ServiceAccount for redis | -| sealed-secrets | object | `{"fullnameOverride":"sealed-secrets-controller","image":{"registry":"quay.io","repository":"codefresh/sealed-secrets-controller","tag":"0.36.0"},"keyrenewperiod":"720h","resources":{"limits":{"cpu":"500m","memory":"1Gi"},"requests":{"cpu":"200m","memory":"512Mi"}}}` | --------------------------------------------------------------------------------------------------------------------- | +| sealed-secrets | object | `{"fullnameOverride":"sealed-secrets-controller","image":{"registry":"docker.io","repository":"octopusdeploy/dhi-sealed-secrets-controller","tag":"0.40.0"},"keyrenewperiod":"720h","resources":{"limits":{"cpu":"500m","memory":"1Gi"},"requests":{"cpu":"200m","memory":"512Mi"}}}` | --------------------------------------------------------------------------------------------------------------------- | | tunnel-client | object | `{"affinity":{},"enabled":true,"libraryMode":true,"nodeSelector":{},"tolerations":[],"tunnelServer":{"host":"register-tunnels.cf-cd.com","subdomainHost":"tunnels.cf-cd.com"}}` | Tunnel based runtime. Not supported for on-prem platform. In on-prem use ingress based runtimes. | | tunnel-client.enabled | bool | `true` | Will only be used if global.runtime.ingress.enabled = false | | tunnel-client.libraryMode | bool | `true` | Do not change this value! Breaks chart logic | diff --git a/charts/gitops-runtime/values.yaml b/charts/gitops-runtime/values.yaml index abbe7769..b378949b 100644 --- a/charts/gitops-runtime/values.yaml +++ b/charts/gitops-runtime/values.yaml @@ -265,9 +265,10 @@ sealed-secrets: fullnameOverride: sealed-secrets-controller keyrenewperiod: "720h" image: - registry: 'quay.io' - repository: 'codefresh/sealed-secrets-controller' - tag: '0.36.0' + registry: 'docker.io' + repository: 'octopusdeploy/dhi-sealed-secrets-controller' + # NB: this overrides version 0.37.0 from bitnami chart version 2.18.6 + tag: '0.40.0' resources: limits: cpu: 500m