webgrip/homelab-cluster
5
0
Fork 0
Code Issues 2 Pull requests 18 Projects Releases Packages Wiki Activity Actions

[PR #21] [MERGED] feat(kube-prometheus-stack): pin container images to SHA256 digests #336

New issue
Closed
opened 2026-06-08 08:31:37 +00:00 by ryangr0 · 0 comments
ryangr0 commented 2026-06-08 08:31:37 +00:00
Owner
Copy link

📋 Pull Request Information

Original PR: https://github.com/webgrip/homelab-cluster/pull/21
Author: @Copilot
Created: 2/23/2026
Status: ✅ Merged
Merged: 2/23/2026
Merged by: @Ryangr0

Base: renovate/flux-controllers-and-oci-artifacts ← Head: copilot/sub-pr-20

📝 Commits (2)

  • b9c708c Initial plan
  • 795be18 feat(kube-prometheus-stack): pin container images to SHA256 digests

📊 Changes

1 file changed (+21 additions, -0 deletions)

View changed files

📝 kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml (+21 -0)

📄 Description

Pins all container images used by kube-prometheus-stack Helm chart (version 82.2.0) to their SHA256 digests for improved security and reproducibility.

Changes Made

Updated kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml to pin the following images:

  • Prometheus Operator (v0.89.0) - sha256:fea93ca9be807eee2f51f4d997b7a2bf073d4051d9012b45b3c84a7b9e8b3f25
  • Prometheus Config Reloader (v0.89.0) - sha256:cb4ac6a56555bef0e202bec11e367dfe07ffb241cf4d30566b12b864692607a8
  • Prometheus (v3.9.1) - sha256:1f0f50f06acaceb0f5670d2c8a658a599affe7b0d8e78b898c1035653849a702
  • Alertmanager (v0.31.1) - sha256:88b605de9aba0410775c1eb3438f951115054e0d307f23f274a4c705f51630c1

Technical Details

  • Images are pinned using the sha field in Helm values
  • Digests fetched from Quay.io using crane tool
  • Pattern consistent with other apps in this repo
  • YAML syntax validated

Benefits

  • Security: Ensures exact image versions are deployed
  • Reproducibility: Guarantees consistent deployments across environments
  • Renovate Integration: Future updates will automatically update digests

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/webgrip/homelab-cluster/pull/21 **Author:** [@Copilot](https://github.com/apps/copilot-swe-agent) **Created:** 2/23/2026 **Status:** ✅ Merged **Merged:** 2/23/2026 **Merged by:** [@Ryangr0](https://github.com/Ryangr0) **Base:** `renovate/flux-controllers-and-oci-artifacts` ← **Head:** `copilot/sub-pr-20` --- ### 📝 Commits (2) - [`b9c708c`](https://github.com/webgrip/homelab-cluster/commit/b9c708c0b841aac6df40b5164b0e75feb80034a0) Initial plan - [`795be18`](https://github.com/webgrip/homelab-cluster/commit/795be18c0982e8473d4c11022f3077f41c1eb24f) feat(kube-prometheus-stack): pin container images to SHA256 digests ### 📊 Changes **1 file changed** (+21 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml` (+21 -0) </details> ### 📄 Description Pins all container images used by kube-prometheus-stack Helm chart (version 82.2.0) to their SHA256 digests for improved security and reproducibility. ## Changes Made Updated `kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml` to pin the following images: - **Prometheus Operator** (v0.89.0) - `sha256:fea93ca9be807eee2f51f4d997b7a2bf073d4051d9012b45b3c84a7b9e8b3f25` - **Prometheus Config Reloader** (v0.89.0) - `sha256:cb4ac6a56555bef0e202bec11e367dfe07ffb241cf4d30566b12b864692607a8` - **Prometheus** (v3.9.1) - `sha256:1f0f50f06acaceb0f5670d2c8a658a599affe7b0d8e78b898c1035653849a702` - **Alertmanager** (v0.31.1) - `sha256:88b605de9aba0410775c1eb3438f951115054e0d307f23f274a4c705f51630c1` ## Technical Details - Images are pinned using the `sha` field in Helm values - Digests fetched from Quay.io using crane tool - Pattern consistent with other apps in this repo - YAML syntax validated ## Benefits - **Security**: Ensures exact image versions are deployed - **Reproducibility**: Guarantees consistent deployments across environments - **Renovate Integration**: Future updates will automatically update digests <!-- START COPILOT CODING AGENT TIPS --> --- ✨ Let Copilot coding agent [set things up for you](https://github.com/webgrip/homelab-cluster/issues/new?title=✨+Set+up+Copilot+instructions&body=Configure%20instructions%20for%20this%20repository%20as%20documented%20in%20%5BBest%20practices%20for%20Copilot%20coding%20agent%20in%20your%20repository%5D%28https://gh.io/copilot-coding-agent-tips%29%2E%0A%0A%3COnboard%20this%20repo%3E&assignees=copilot) — coding agent works faster and does higher quality work when set up for your repo. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
ryangr0 2026-06-08 08:31:37 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
renovate/patch-mise-tools
renovate/harbor.webgrip.dev-dockerhub-amazon-aws-cli-2.36.x
renovate/docker.io-amazon-aws-cli-2.36.x
fix/litellm-ingress-ploeg
renovate/harbor.webgrip.dev-dockerhub-n8nio-n8n-2.x
renovate/harbor.webgrip.dev-dockerhub-python-3.14-alpine
renovate/docker.io-python-3.14-slim
renovate/harbor.webgrip.dev-dockerhub-n8nio-n8n-2.34.x
renovate/harbor.webgrip.dev-dockerhub-library-docker-29.7.x
feat/ploeg-bench-team
fix/runner-mem-request-node-pressure
fix/runner-mem-grype-oom
fix/harbor-ci-robot-tag-delete
renovate/platform-patch-flux-oci-helm-charts-(platform)
renovate/docker.io-renovate-renovate-43.x
renovate/ghcr.io-siderolabs-kubelet-1.36.x
renovate/harbor.webgrip.dev-dockerhub-dxflrs-garage-2.x
renovate/docker.io-alpine-3.x
renovate/patch-flux-controllers
renovate/harbor.webgrip.dev-dockerhub-invoiceninja-invoiceninja-5.13.x
feat/retire-ghcr-policies
feat/renovate-enable-gomod
No results found.
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

No labels
pull-request
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
webgrip/homelab-cluster#336
No description provided.