Lock default OCI images

[gberche-orange]

Thanks for maintaining this helm release !

As a oauth2-proxy user,
In order to avoid that a bump to sso-proxy automatically deploy to my production system,
And in order to ensure that OCI image bumps are compatible with Helm chart versions
I need the default OCI images to be specified in the values.yaml

Currently no tag is specified, resulting to using latest AFAIK

manifests/helm/oauth2-proxy/values.yaml

Lines 77 to 82 in a457c15

	image:
	repository: "quay.io/oauth2-proxy/oauth2-proxy"
	# appVersion is used by default
	tag: ""
	pullPolicy: "IfNotPresent"
	command: []

[tuunit]

#353 (comment)

This will introduce an additional place to maintain the version which is already specified and updated in the Chart.yaml

[gberche-orange]

Thanks for reviewing this suggestion and PR

#353 (comment)

Any suggestion on how to achieve the goal of locking the default image version while preserving helm chart best practices ?
Bitnami seems to be handling it though annotations in the charts.yaml
see https://github.com/bitnami/charts/blob/f25c8f4fbabdf66fa9094311cb94304a16fb698d/bitnami/oauth2-proxy/Chart.yaml#L4-L11

This will introduce an additional place to maintain the version which is already specified and updated in the Chart.yaml

Renovate can be configured to update the Chart.yaml in the same PR using the regexp manager, see https://docs.renovatebot.com/modules/manager/regex/

See sample usage at https://github.com/idoshalev058/k3sinfra/blame/7210a727186957f80f22c1f90d83c217968506bf/woodpecker/helm-main/renovate.json#L13-L22 and https://github.com/idoshalev058/k3sinfra/blob/7210a727186957f80f22c1f90d83c217968506bf/woodpecker/helm-main/charts/woodpecker/charts/agent/Chart.yaml#L6-L7

[tuunit]

Why aren't you just setting the tag / version you want in your deployment values.yaml ?

Am I misunderstanding the problem?