fix(chart): honour image.repository/image.tag instead of hardcoding Docker Hub - #128
Conversation
…ocker Hub
The playground deploy of 8.0.0 is in ImagePullBackOff:
Failed to pull image "docker.io/simplify9/mtm:8.0.0": not found
deployment.yaml hardcoded the image as
docker.io/simplify9/{{ .Chart.Name }}:{{ .Chart.Version }}
so it ignored the image.repository and image.tag values the CI pipeline has
been passing all along (reusable-service-cicd.yml sets image-repository to
"<container-registry>/<image-name>" and image-tag to the computed version,
which helm-deploy turns into --set image.repository=... --set image.tag=...).
ci-cd.yml's own comment documented this bug.
CI publishes to ghcr.io. Docker Hub has received no push since 6.0.8
(Aug 2025, the retired Azure pipeline), so every version from 8.0.0 onward
is missing there. Confirmed: docker.io/simplify9/mtm:8.0.0 -> HTTP 404,
ghcr.io/simplify9/mtm:8.0.0 -> pulls anonymously and carries
Microsoft.AspNetCore.App 8.0.30.
- _helpers.tpl: new `project.image`, defaulting to
ghcr.io/simplify9/<chart name>:<chart version>.
- deployment.yaml: use it.
- values.yaml: declare image.repository and image.tag (both empty = default).
The default registry changes from docker.io to ghcr.io. That is the point:
ghcr.io is the only registry carrying images for current chart versions.
Anyone needing the old one can set image.repository=docker.io/simplify9/mtm.
Verified: helm lint --strict clean; default renders
ghcr.io/simplify9/mtm:<version>; the pipeline's exact --set renders
ghcr.io/simplify9/mtm:8.0.0; and rendering against the live values of all
six releases changes exactly two lines each - the image registry, nothing
else.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VHkpqv6dB6wjALyFe9ocMU
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: simplify9/coderabbit/.coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details🧰 Additional context used📓 Path-based instructions (1)Review Helm chart changes for insecure defaults, exposed services,⚙️ CodeRabbit configuration file Files:
🪛 Trivy (0.73.0)charts/default/templates/deployment.yaml[warning] 28-76: Can elevate its own privileges Container 'mtm' of Deployment 'mtm' should set 'securityContext.allowPrivilegeEscalation' to false Rule: KSV-0001 (IaC/Kubernetes) [info] 28-76: Default capabilities: some containers do not drop all Container 'mtm' of Deployment 'mtm' should add 'ALL' to 'securityContext.capabilities.drop' Rule: KSV-0003 (IaC/Kubernetes) [info] 28-76: Default capabilities: some containers do not drop any Container 'mtm' of 'deployment' 'mtm' in 'default' namespace should set securityContext.capabilities.drop Rule: KSV-0004 (IaC/Kubernetes) [info] 28-76: CPU not limited Container 'mtm' of Deployment 'mtm' should set 'resources.limits.cpu' Rule: KSV-0011 (IaC/Kubernetes) [warning] 28-76: Runs as root user Container 'mtm' of Deployment 'mtm' should set 'securityContext.runAsNonRoot' to true Rule: KSV-0012 (IaC/Kubernetes) [error] 28-76: Root file system is not read-only Container 'mtm' of Deployment 'mtm' should set 'securityContext.readOnlyRootFilesystem' to true Rule: KSV-0014 (IaC/Kubernetes) [info] 28-76: CPU requests not specified Container 'mtm' of Deployment 'mtm' should set 'resources.requests.cpu' Rule: KSV-0015 (IaC/Kubernetes) [info] 28-76: Memory requests not specified Container 'mtm' of Deployment 'mtm' should set 'resources.requests.memory' Rule: KSV-0016 (IaC/Kubernetes) [info] 28-76: Memory not limited Container 'mtm' of Deployment 'mtm' should set 'resources.limits.memory' Rule: KSV-0018 (IaC/Kubernetes) [info] 28-76: Runs with UID <= 10000 Container 'mtm' of Deployment 'mtm' should set 'securityContext.runAsUser' > 10000 Rule: KSV-0020 (IaC/Kubernetes) [info] 28-76: Runs with GID <= 10000 Container 'mtm' of Deployment 'mtm' should set 'securityContext.runAsGroup' > 10000 Rule: KSV-0021 (IaC/Kubernetes) [info] 28-76: Runtime/Default Seccomp profile not set Either Pod or Container should set 'securityContext.seccompProfile.type' to 'RuntimeDefault' Rule: KSV-0030 (IaC/Kubernetes) [warning] 28-76: Seccomp policies disabled container "mtm" of deployment "mtm" in "default" namespace should specify a seccomp profile Rule: KSV-0104 (IaC/Kubernetes) [info] 28-76: Container capabilities must only include NET_BIND_SERVICE container should drop all Rule: KSV-0106 (IaC/Kubernetes) [error] 28-76: Default security context configured container mtm in default namespace is using the default security context Rule: KSV-0118 (IaC/Kubernetes) [error] 26-76: Default security context configured deployment mtm in default namespace is using the default security context, which allows root privileges Rule: KSV-0118 (IaC/Kubernetes) [warning] 28-76: Restrict container images to trusted registries Container mtm in deployment mtm (namespace: default) uses an image from an untrusted registry. Rule: KSV-0125 (IaC/Kubernetes) 🪛 YAMLlint (1.37.1)charts/default/templates/deployment.yaml[error] 28-28: syntax error: expected , but found '' (syntax) 🔇 Additional comments (3)
📝 WalkthroughSummary
Risk: Security-sensitive areas: Container image source and tag resolution changed. Review registry access and image provenance. No authentication or application security logic changed. Test coverage impact: Helm linting and renders cover default values, pipeline-specific values, old-registry overrides, and six release comparisons. Operational concerns: Existing deployments may pull from GHCR instead of Docker Hub. Ensure GHCR images and registry credentials are available before upgrade. Users can override the repository and tag. Rollback restores the previous chart behavior if the prior chart version remains available. WalkthroughThe chart adds configurable image repository and tag values, resolves defaults through a new ChangesContainer image configuration
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to The chart now honors configured image repositories and tags, defaulting current releases to the available public registry; no actionable merge-blocking risk remains after normal checks and review. Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.) Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Root cause
deployment.yamlhardcoded the image:So it ignored the
image.repositoryandimage.tagvalues the CI pipeline has been passing all along —reusable-service-cicd.ymlsetsimage-repositoryto<container-registry>/<image-name>andimage-tagto the computed version, whichhelm-deployturns into--set image.repository=… --set image.tag=….ci-cd.yml's own inline comment documented this bug.CI publishes to ghcr.io. Docker Hub has had no push since
6.0.8(Aug 2025, from the retired Azure pipeline), so every version from8.0.0on is simply absent there:8.0.0docker.io/simplify9/mtm6.0.8ghcr.io/simplify9/mtm8.0.0Confirmed live on the cluster —
playground/mtmrunsdocker.io/simplify9/mtm:8.0.0from chartmtm-8.0.0, stateImagePullBackOff.Change
_helpers.tpl— newproject.image, defaulting toghcr.io/simplify9/<chart name>:<chart version>deployment.yaml— use itvalues.yaml— declareimage.repositoryandimage.tag(empty = default)That is deliberate, and it is the fix.
ghcr.iois the only registry carrying images for current chart versions, and the package is public — verified with an anonymous pull afterdocker logout ghcr.io, so noimagePullSecretis needed. Anyone who needs the old registry can setimage.repository=docker.io/simplify9/mtm.This also matters beyond playground: the chart backs six releases (funride / kwickbox / tamweelna × staging/production). Without this, any of them moving to chart
8.0.xwould hit the sameImagePullBackOff.Verification
helm lint --strictghcr.io/simplify9/mtm:<chart version>--setghcr.io/simplify9/mtm:8.0.0--set image.repository=docker.io/simplify9/mtm)docker.io/simplify9/mtm:6.0.8ghcr.io/simplify9/mtm:8.0.0Microsoft.AspNetCore.App 8.0.30Note
mtm-8.0.0is now oncharts.sf9.ioand containshttproute.yaml— the first gateway-capable published chart. Downstream callers should pin8.0.1(this fix), not8.0.0, or they inherit the Docker Hub 404.🤖 Generated with Claude Code
https://claude.ai/code/session_01VHkpqv6dB6wjALyFe9ocMU