From c1ef155295e34e7b550f4948affdb6ef14e52f26 Mon Sep 17 00:00:00 2001 From: Josip Rodin Date: Mon, 21 Sep 2026 10:47:06 +0200 Subject: [PATCH 1/5] feat(sealed-secrets): use Docker Hardened Images --- charts/gitops-runtime/Chart.yaml | 4 +++- charts/gitops-runtime/values.yaml | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/charts/gitops-runtime/Chart.yaml b/charts/gitops-runtime/Chart.yaml index 75db7209..cc892bef 100644 --- a/charts/gitops-runtime/Chart.yaml +++ b/charts/gitops-runtime/Chart.yaml @@ -25,7 +25,9 @@ dependencies: version: 0.45.25-v3.6.7-cap-CFS-15235 condition: argo-workflows.enabled - name: sealed-secrets - repository: https://bitnami.github.io/sealed-secrets + # TODO: remove dev for release + repository: oci://quay.io/codefresh/dev/sealed-secrets-controller + # TODO: should be safe to upgrade to latest version: 2.18.0 condition: sealed-secrets.enabled - name: codefresh-tunnel-client diff --git a/charts/gitops-runtime/values.yaml b/charts/gitops-runtime/values.yaml index 23999964..4b5fa648 100644 --- a/charts/gitops-runtime/values.yaml +++ b/charts/gitops-runtime/values.yaml @@ -267,6 +267,7 @@ sealed-secrets: image: registry: 'quay.io' repository: 'codefresh/sealed-secrets-controller' + # TODO this corresponds to bitnami chart version 2.18.2 but we had 2.18.0, sync them tag: '0.36.0' resources: limits: From d45d67d3bdd60e0f47e9c26262779ce0e16c7b48 Mon Sep 17 00:00:00 2001 From: Josip Rodin Date: Mon, 21 Sep 2026 11:22:04 +0200 Subject: [PATCH 2/5] fix(sealed-secrets): keep the chart as is, just override the image to use our DHI mirror --- charts/gitops-runtime/Chart.yaml | 3 +-- charts/gitops-runtime/values.yaml | 4 ++-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/charts/gitops-runtime/Chart.yaml b/charts/gitops-runtime/Chart.yaml index cc892bef..bd7da458 100644 --- a/charts/gitops-runtime/Chart.yaml +++ b/charts/gitops-runtime/Chart.yaml @@ -25,8 +25,7 @@ dependencies: version: 0.45.25-v3.6.7-cap-CFS-15235 condition: argo-workflows.enabled - name: sealed-secrets - # TODO: remove dev for release - repository: oci://quay.io/codefresh/dev/sealed-secrets-controller + repository: https://bitnami.github.io/sealed-secrets # TODO: should be safe to upgrade to latest version: 2.18.0 condition: sealed-secrets.enabled diff --git a/charts/gitops-runtime/values.yaml b/charts/gitops-runtime/values.yaml index 4b5fa648..6a54419a 100644 --- a/charts/gitops-runtime/values.yaml +++ b/charts/gitops-runtime/values.yaml @@ -265,8 +265,8 @@ sealed-secrets: fullnameOverride: sealed-secrets-controller keyrenewperiod: "720h" image: - registry: 'quay.io' - repository: 'codefresh/sealed-secrets-controller' + registry: 'docker.io' + repository: 'octopusdeploy/dhi-sealed-secrets-controller' # TODO this corresponds to bitnami chart version 2.18.2 but we had 2.18.0, sync them tag: '0.36.0' resources: From d010f5cea8970aa8a47c8915310ea767b35afdcb Mon Sep 17 00:00:00 2001 From: Josip Rodin Date: Mon, 21 Sep 2026 11:35:15 +0200 Subject: [PATCH 3/5] fix(sealed-secrets): helm-docs.sh --- charts/gitops-runtime/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/gitops-runtime/README.md b/charts/gitops-runtime/README.md index 2ff30bea..12ccb47a 100644 --- a/charts/gitops-runtime/README.md +++ b/charts/gitops-runtime/README.md @@ -813,7 +813,7 @@ global: | redis.readinessProbe | object | `{"enabled":true,"failureThreshold":5,"initialDelaySeconds":30,"periodSeconds":15,"successThreshold":1,"timeoutSeconds":15}` | Probes configuration | | redis.service | object | `{"annotations":{},"labels":{},"ports":{"metrics":{"port":9121,"targetPort":9121},"redis":{"port":6379,"targetPort":6379}},"type":"ClusterIP"}` | Service configuration | | redis.serviceAccount | object | `{"annotations":{},"create":true,"name":""}` | Create ServiceAccount for redis | -| sealed-secrets | object | `{"fullnameOverride":"sealed-secrets-controller","image":{"registry":"quay.io","repository":"codefresh/sealed-secrets-controller","tag":"0.36.0"},"keyrenewperiod":"720h","resources":{"limits":{"cpu":"500m","memory":"1Gi"},"requests":{"cpu":"200m","memory":"512Mi"}}}` | --------------------------------------------------------------------------------------------------------------------- | +| sealed-secrets | object | `{"fullnameOverride":"sealed-secrets-controller","image":{"registry":"docker.io","repository":"octopusdeploy/dhi-sealed-secrets-controller","tag":"0.36.0"},"keyrenewperiod":"720h","resources":{"limits":{"cpu":"500m","memory":"1Gi"},"requests":{"cpu":"200m","memory":"512Mi"}}}` | --------------------------------------------------------------------------------------------------------------------- | | tunnel-client | object | `{"affinity":{},"enabled":true,"libraryMode":true,"nodeSelector":{},"tolerations":[],"tunnelServer":{"host":"register-tunnels.cf-cd.com","subdomainHost":"tunnels.cf-cd.com"}}` | Tunnel based runtime. Not supported for on-prem platform. In on-prem use ingress based runtimes. | | tunnel-client.enabled | bool | `true` | Will only be used if global.runtime.ingress.enabled = false | | tunnel-client.libraryMode | bool | `true` | Do not change this value! Breaks chart logic | From 8d42227319dcfb76c57860247d0f3d5510a746dd Mon Sep 17 00:00:00 2001 From: Josip Rodin Date: Mon, 21 Sep 2026 11:37:20 +0200 Subject: [PATCH 4/5] feat(sealed-secrets): bump version to latest documented by bitnami chart --- charts/gitops-runtime/Chart.yaml | 2 +- charts/gitops-runtime/README.md | 2 +- charts/gitops-runtime/values.yaml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/charts/gitops-runtime/Chart.yaml b/charts/gitops-runtime/Chart.yaml index bd7da458..819dbb87 100644 --- a/charts/gitops-runtime/Chart.yaml +++ b/charts/gitops-runtime/Chart.yaml @@ -27,7 +27,7 @@ dependencies: - name: sealed-secrets repository: https://bitnami.github.io/sealed-secrets # TODO: should be safe to upgrade to latest - version: 2.18.0 + version: 2.18.6 condition: sealed-secrets.enabled - name: codefresh-tunnel-client repository: oci://quay.io/codefresh/charts diff --git a/charts/gitops-runtime/README.md b/charts/gitops-runtime/README.md index 12ccb47a..7b43265b 100644 --- a/charts/gitops-runtime/README.md +++ b/charts/gitops-runtime/README.md @@ -813,7 +813,7 @@ global: | redis.readinessProbe | object | `{"enabled":true,"failureThreshold":5,"initialDelaySeconds":30,"periodSeconds":15,"successThreshold":1,"timeoutSeconds":15}` | Probes configuration | | redis.service | object | `{"annotations":{},"labels":{},"ports":{"metrics":{"port":9121,"targetPort":9121},"redis":{"port":6379,"targetPort":6379}},"type":"ClusterIP"}` | Service configuration | | redis.serviceAccount | object | `{"annotations":{},"create":true,"name":""}` | Create ServiceAccount for redis | -| sealed-secrets | object | `{"fullnameOverride":"sealed-secrets-controller","image":{"registry":"docker.io","repository":"octopusdeploy/dhi-sealed-secrets-controller","tag":"0.36.0"},"keyrenewperiod":"720h","resources":{"limits":{"cpu":"500m","memory":"1Gi"},"requests":{"cpu":"200m","memory":"512Mi"}}}` | --------------------------------------------------------------------------------------------------------------------- | +| sealed-secrets | object | `{"fullnameOverride":"sealed-secrets-controller","image":{"registry":"docker.io","repository":"octopusdeploy/dhi-sealed-secrets-controller","tag":"0.37.0"},"keyrenewperiod":"720h","resources":{"limits":{"cpu":"500m","memory":"1Gi"},"requests":{"cpu":"200m","memory":"512Mi"}}}` | --------------------------------------------------------------------------------------------------------------------- | | tunnel-client | object | `{"affinity":{},"enabled":true,"libraryMode":true,"nodeSelector":{},"tolerations":[],"tunnelServer":{"host":"register-tunnels.cf-cd.com","subdomainHost":"tunnels.cf-cd.com"}}` | Tunnel based runtime. Not supported for on-prem platform. In on-prem use ingress based runtimes. | | tunnel-client.enabled | bool | `true` | Will only be used if global.runtime.ingress.enabled = false | | tunnel-client.libraryMode | bool | `true` | Do not change this value! Breaks chart logic | diff --git a/charts/gitops-runtime/values.yaml b/charts/gitops-runtime/values.yaml index 6a54419a..c2cb5a8e 100644 --- a/charts/gitops-runtime/values.yaml +++ b/charts/gitops-runtime/values.yaml @@ -267,8 +267,8 @@ sealed-secrets: image: registry: 'docker.io' repository: 'octopusdeploy/dhi-sealed-secrets-controller' - # TODO this corresponds to bitnami chart version 2.18.2 but we had 2.18.0, sync them - tag: '0.36.0' + # NB: this corresponds to bitnami chart version 2.18.6 + tag: '0.37.0' resources: limits: cpu: 500m From 8fdb2d2ca04cf16e56e1647629590be167c4b61e Mon Sep 17 00:00:00 2001 From: Josip Rodin Date: Tue, 22 Sep 2026 10:41:44 +0200 Subject: [PATCH 5/5] feat(sealed-secrets): bump version to the one that got mirrored to our repo --- charts/gitops-runtime/README.md | 2 +- charts/gitops-runtime/values.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/gitops-runtime/README.md b/charts/gitops-runtime/README.md index 7b43265b..7d1d822d 100644 --- a/charts/gitops-runtime/README.md +++ b/charts/gitops-runtime/README.md @@ -813,7 +813,7 @@ global: | redis.readinessProbe | object | `{"enabled":true,"failureThreshold":5,"initialDelaySeconds":30,"periodSeconds":15,"successThreshold":1,"timeoutSeconds":15}` | Probes configuration | | redis.service | object | `{"annotations":{},"labels":{},"ports":{"metrics":{"port":9121,"targetPort":9121},"redis":{"port":6379,"targetPort":6379}},"type":"ClusterIP"}` | Service configuration | | redis.serviceAccount | object | `{"annotations":{},"create":true,"name":""}` | Create ServiceAccount for redis | -| sealed-secrets | object | `{"fullnameOverride":"sealed-secrets-controller","image":{"registry":"docker.io","repository":"octopusdeploy/dhi-sealed-secrets-controller","tag":"0.37.0"},"keyrenewperiod":"720h","resources":{"limits":{"cpu":"500m","memory":"1Gi"},"requests":{"cpu":"200m","memory":"512Mi"}}}` | --------------------------------------------------------------------------------------------------------------------- | +| sealed-secrets | object | `{"fullnameOverride":"sealed-secrets-controller","image":{"registry":"docker.io","repository":"octopusdeploy/dhi-sealed-secrets-controller","tag":"0.40.0"},"keyrenewperiod":"720h","resources":{"limits":{"cpu":"500m","memory":"1Gi"},"requests":{"cpu":"200m","memory":"512Mi"}}}` | --------------------------------------------------------------------------------------------------------------------- | | tunnel-client | object | `{"affinity":{},"enabled":true,"libraryMode":true,"nodeSelector":{},"tolerations":[],"tunnelServer":{"host":"register-tunnels.cf-cd.com","subdomainHost":"tunnels.cf-cd.com"}}` | Tunnel based runtime. Not supported for on-prem platform. In on-prem use ingress based runtimes. | | tunnel-client.enabled | bool | `true` | Will only be used if global.runtime.ingress.enabled = false | | tunnel-client.libraryMode | bool | `true` | Do not change this value! Breaks chart logic | diff --git a/charts/gitops-runtime/values.yaml b/charts/gitops-runtime/values.yaml index c2cb5a8e..ac739f52 100644 --- a/charts/gitops-runtime/values.yaml +++ b/charts/gitops-runtime/values.yaml @@ -267,8 +267,8 @@ sealed-secrets: image: registry: 'docker.io' repository: 'octopusdeploy/dhi-sealed-secrets-controller' - # NB: this corresponds to bitnami chart version 2.18.6 - tag: '0.37.0' + # NB: this overrides version 0.37.0 from bitnami chart version 2.18.6 + tag: '0.40.0' resources: limits: cpu: 500m