Enforce immutable supply chain defaults

deploy/charts/remora/templates/_helpers.tpl

@@ -3,6 +3,15 @@
 {{- end -}}
 
 {{- define "remora.validateValues" -}}
+{{- range $component := list "api" "worker" "web" -}}
+{{- $image := (get $.Values $component).image -}}
+{{- if and (not $image.digest) (not $image.allowTag) -}}
+{{- fail (printf "%s.image.digest is required unless %s.image.allowTag is true" $component $component) -}}
+{{- end -}}
+{{- end -}}
+{{- if and (not (regexMatch "@sha256:[0-9a-f]{64}$" .Values.vault.image)) (not .Values.vault.allowTag) -}}
+{{- fail "vault.image must use a sha256 digest unless vault.allowTag is true" -}}
+{{- end -}}
 {{- if ge (int .Values.runtime.workerRenewSeconds) (int .Values.coordination.leaseTtlSeconds) -}}
 {{- fail "runtime.workerRenewSeconds must be less than coordination.leaseTtlSeconds" -}}
 {{- end -}}

deploy/charts/remora/values.schema.json

@@ -124,6 +124,7 @@
       "additionalProperties": false,
       "required": [
         "image",
+        "allowTag",
         "address",
         "path",
         "kubernetesAuthMount",
@@ -134,6 +135,7 @@
       ],
       "properties": {
         "image": {"$ref": "#/$defs/nonEmpty"},
+        "allowTag": {"type": "boolean"},
         "address": {"$ref": "#/$defs/httpUrl"},
         "path": {"$ref": "#/$defs/nonEmpty"},
         "kubernetesAuthMount": {"$ref": "#/$defs/nonEmpty"},
@@ -346,11 +348,12 @@
     "image": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["repository", "tag", "digest", "pullPolicy"],
+      "required": ["repository", "tag", "digest", "allowTag", "pullPolicy"],
       "properties": {
         "repository": {"$ref": "#/$defs/nonEmpty"},
         "tag": {"$ref": "#/$defs/nonEmpty"},
         "digest": {"type": "string", "pattern": "^(|sha256:[0-9a-f]{64})$"},
+        "allowTag": {"type": "boolean"},
         "pullPolicy": {"enum": ["Always", "IfNotPresent", "Never"]}
       }
     },

deploy/charts/remora/values.yaml

@@ -11,6 +11,7 @@ api:
     repository: remora-api
     tag: 0.0.0
     digest: ""
+    allowTag: false
     pullPolicy: IfNotPresent
   resources:
     requests:
@@ -26,6 +27,7 @@ worker:
     repository: remora-worker
     tag: 0.0.0
     digest: ""
+    allowTag: false
     pullPolicy: IfNotPresent
   resources:
     requests:
@@ -41,6 +43,7 @@ web:
     repository: remora-web
     tag: 0.0.0
     digest: ""
+    allowTag: false
     pullPolicy: IfNotPresent
   publicOrigin: https://remora.example.com
   oidcClientId: remora-web
@@ -98,6 +101,7 @@ target:
 
 vault:
   image: hashicorp/vault@sha256:db6a5f78749204d0a8d002be1cc6e9a2a6de53dffce41a894c4a06d309dca360
+  allowTag: false
   address: https://vault.example.com
   path: remora
   kubernetesAuthMount: auth/kubernetes