Merge #261

261: feat: add digest support for image r=brunoocasali a=R0BB3RT

# Pull Request

## Related issue
Fixes #260 

## What does this PR do?
- Adds support for specifying a container image by digest in the Meilisearch Helm chart.
- This makes it possible to deploy Meilisearch in Kubernetes clusters that enforce immutable image references (e.g., via Sigstore Policy Controller).
- The change is backward-compatible: existing repository:tag configurations continue to work without modification.

## Basic example
```
image:
  repository: getmeili/meilisearch
  digest: "sha256:19b825993dbe80c61eec65de7e7096cd545a09a744d8d00f3dd117185ebb36f9"
  tag: ""   # leave empty when using digest
```

Renders as:
`image: getmeili/meilisearch@sha256:19b825993dbe80c61eec65de7e7096cd545a09a744d8d00f3dd117185ebb36f9`

If digest is not defined, the chart continues to render:
`image: getmeili/meilisearch:latest`
(or whatever tag is provided).

## PR checklist
Please check if your PR fulfills the following requirements:
- [x] Does this PR fix an existing issue, or have you listed the changes applied in the PR description (and why they are needed)?
- [x] Have you read the contributing guidelines?
- [x] Have you made sure that the title is accurate and descriptive of the changes?

Co-authored-by: R0BB3RT <[email protected]>
Co-authored-by: Bruno Casali <[email protected]>
Co-authored-by: brunoocasali <[email protected]>

Author: 3 people

charts/meilisearch/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 appVersion: "v1.18.0"
 description: A Helm chart for the Meilisearch search engine
 name: meilisearch
-version: 0.17.0
+version: 0.17.1
 icon: https://raw.githubusercontent.com/meilisearch/integration-guides/main/assets/logos/logo.svg
 home: https://github.com/meilisearch/meilisearch-kubernetes/tree/main/charts/meilisearch
 maintainers:

charts/meilisearch/README.md

@@ -68,6 +68,7 @@ You can also use `auth.existingMasterKeySecret` to use an existing secret that h
 | image.pullSecret | string | `nil` | Secret to authenticate against the docker registry |
 | image.repository | string | `"getmeili/meilisearch"` | Meilisearch image name |
 | image.tag | string | `"v1.2.0"` | Meilisearch image tag |
+| image.digest | string | `""` | 	Meilisearch image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag |
 | ingress.annotations | object | `{}` | Ingress annotations |
 | ingress.className | string | `"nginx"` | Ingress ingressClassName |
 | ingress.enabled | bool | `false` | Enable ingress controller resource |

charts/meilisearch/templates/statefulset.yaml

@@ -57,7 +57,7 @@ spec:
 
       containers:
         - name: {{ .Chart.Name }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          image: "{{ .Values.image.repository }}{{- if .Values.image.digest }}@{{ .Values.image.digest }}{{- else }}:{{ .Values.image.tag }}{{- end }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           securityContext:
 {{ toYaml .Values.securityContext | indent 12 }}

manifests/meilisearch.yaml

@@ -75,7 +75,7 @@ spec:
         app.kubernetes.io/component: search-engine
         app.kubernetes.io/part-of: meilisearch
       annotations:
-        checksum/config: e94f5cb3ce20f3053874a38a565d15332a00d03e78a7d14f0dc491ee22aeac5b
+        checksum/config: 46784f3f8961bc1abfab68cae9f48677d8e1334cbaffd6c4f2cf0da7aa56a4ac
     spec:
       serviceAccountName: meilisearch
       securityContext: