Pull by digest (#11)

* pull by digest

* no more rolling restart

Author: james-otten

.github/workflows/helm_deploy.yaml

@@ -54,6 +54,3 @@ jobs:
             --set github_client_id="${{ secrets.GH_CLIENT_ID }}" \
             --set github_install_id="${{ secrets.GH_INSTALL_ID }}" \
             --set github_secret="${{ secrets.GH_APP_KEY }}"
-          
-          # Rolling restart
-          kubectl --kubeconfig ./config --server https://${{ secrets.SSH_TARGET_IP }}:6443 -n ${{ vars.APP_NAMESPACE }} rollout restart statefulset

website-map/templates/backend.yaml

@@ -33,7 +33,11 @@ spec:
         - name: {{ .Chart.Name }}-backend
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
+          {{- if .Values.backend.image.digest }}
+          image: "{{ .Values.backend.image.repository }}@{{ .Values.backend.image.digest }}"
+          {{- else }}
           image: "{{ .Values.backend.image.repository }}:{{ .Values.backend.image.tag }}"
+          {{- end }}
           imagePullPolicy: {{ .Values.backend.image.pullPolicy }}
           ports:
             - name: http
@@ -67,7 +71,11 @@ spec:
             {{- toYaml .Values.backend.resources | nindent 12 }}
       initContainers:
         - name: update-map-cron
+          {{- if .Values.cron.image.digest }}
+          image: "{{ .Values.cron.image.repository }}@{{ .Values.cron.image.digest }}"
+          {{- else }}
           image: "{{ .Values.cron.image.repository }}:{{ .Values.cron.image.tag }}"
+          {{- end }}
           imagePullPolicy: {{ .Values.cron.image.pullPolicy }}
           restartPolicy: Always
           command: ['sh', '/map.entrypoint.sh']

website-map/values.yaml

@@ -3,7 +3,8 @@ backend:
   image:
     repository: docker.io/nginx
     pullPolicy: IfNotPresent
-    tag: "latest"
+    # tag: "1.27.5-bookworm"
+    digest: sha256:c15da6c91de8d2f436196f3a768483ad32c258ed4e1beb3d367a27ed67253e66
   service:
     type: ClusterIP
     port: 80
@@ -18,7 +19,8 @@ cron:
   image:
     repository: docker.io/python
     pullPolicy: IfNotPresent
-    tag: "3.13-alpine"
+    # tag: "3.13-alpine3.21"
+    digest: sha256:f80206d96683c1b27cd522dc300f791a48362b895ad5c0bdd26f78f853c76fa5
 
 imageCredentials:
   registry: docker.io