[helm-values] support digest with/without tag

[rarkins]

Discussed in #26710

^{Originally posted by ira-gordin-sap January 17, 2024}

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us what version of Renovate you run.

37.105.0

If you're self-hosting Renovate, select which platform you are using.

github.com

What is your question?

How to configure digest to work here?:

image:
  registry: docker.io
  repository: busybox
  digest: sha256:4b6ad3a68d34da29bf7c8ccb5d355ba8b4babcad1f99798204e7abb43e54ee3d

Logs (if relevant)

Logs

Copy/paste the relevant log(s) here, between the starting and ending backticks

[rarkins]

Reproduction repo: https://github.com/renovate-reproductions/26719

[rarkins]

Currently Renovate ignores an image entry unless it has tag or version:

renovate/lib/modules/manager/helm-values/util.ts

Line 37 in 13edab3

(hasKey('tag', data) || hasKey('version', data))

[luweilevi]

I have the same configuration in my helm values.yaml file. Need renovate to support updating digest without tag.

image:
  registry: docker.io
  repository: busybox
  digest: sha256:4b6ad3a68d34da29bf7c8ccb5d355ba8b4babcad1f99798204e7abb43e54ee3d

[rarkins]

What is the point of your comment? I don't see any new information

[ira-gordin-sap]

I have the same configuration in my helm values.yaml file. Need renovate to support updating digest without tag.

image:
  registry: docker.io
  repository: busybox
  digest: sha256:4b6ad3a68d34da29bf7c8ccb5d355ba8b4babcad1f99798204e7abb43e54ee3d

@luweilevi did you find some solution?

[na-jakobs]

This would be nice to have in RenovateBot 👍

But in the current version of RenovateBot you can enable pinDigests: true in the helm-values manager:

renovate.json:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended"
  ],
  "labels": [
    "dependencies"
  ],
  "groupName": "dependencies",
  "enabledManagers": [
    "helm-values"
  ],
  "helm-values": {
    "enabled": true,
    "pinDigests": true
  }
}

And by updating your template you can extract the SHA that RenovateBot adds/updates and add the digest key and value:

values.yaml after RenovateBot update:

image:
  repository: nginx
  pullPolicy: IfNotPresent
  tag: 1.24@sha256:e56797eab4a5300158cc015296229e13a390f82bfc88803f45b08912fd5e3348

templates/deployment.yaml:

      containers:
        - name: {{ .Chart.Name }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          {{- with split "@" .Values.image.tag }}
          digest: {{ index . "_1" }}
          {{- end }}

✨ helm template output:

      containers:
        - name: nginx-digest
          securityContext:
            {}
          image: "nginx:1.24@sha256:e56797eab4a5300158cc015296229e13a390f82bfc88803f45b08912fd5e3348"
          imagePullPolicy: IfNotPresent
          digest: sha256:e56797eab4a5300158cc015296229e13a390f82bfc88803f45b08912fd5e3348

[ira-gordin-sap]

@na-jakobs Will it work for the following:image:
registry: docker.io
repository: busybox
digest: sha256:4b6ad3a68d34da29bf7c8ccb5d355ba8b4babcad1f99798204e7abb43e54ee3d
?

[na-jakobs]

@ira-gordin-sap You can update the helm template to populate your digest value when you run helm template. If you run RenovateBot with:

  "helm-values": {
    "enabled": true,
    "pinDigests": true
  }

values.yaml:

image:
  registry: docker.io
  repository: curlimages/curl
  tag: 8.2.0

It will create a PR and pin the tag and digest:

PR title: Update docker.io/curlimages/curl Docker tag to v8.7.1

image:
  registry: docker.io
  repository: curlimages/curl
  - tag: 8.2.0
  + tag: 8.7.1@sha256:25d29daeb9b14b89e2fa8cc17c70e4b188bca1466086907c2d9a4b56b59d8e21

And if you update your template you will get the digest value from the tag value.

Templated Helm chart:

image:
  registry: docker.io
  repository: curlimages/curl
  tag: 8.7.1@sha256:25d29daeb9b14b89e2fa8cc17c70e4b188bca1466086907c2d9a4b56b59d8e21
  digest: sha256:25d29daeb9b14b89e2fa8cc17c70e4b188bca1466086907c2d9a4b56b59d8e21

This may not be exactly what you need but maybe you can use this as a workaround for your use-case.

[na-jakobs]

It would still be nice to see this in RenovateBot, being able to configure if the digest should be placed with the tag, in a separate key or both @rarkins

[github-actions]

Hi there,

This is intended as a polite, automated request that users avoid @ mentioning repository maintainers like @rarkins or @viceice. Doing so causes annoying mobile notifications and makes it harder to maintain this repository.

We know it might be common elsewhere but we participate in hundreds of discussions a week and would need to turn off GitHub mobile notifications if we were mentioned in every one.

As a general rule, we will read and respond to all discussions in this repository, so there is no need to mention us.

Thanks, the Renovate team