Repository navigation
fix: support image.digest and keep app.kubernetes.io/version a valid label - #43
Open
eightseventhreethree wants to merge 1 commit into
Open
eightseventhreethree wants to merge 1 commit into
eightseventhreethree wants to merge 1 commit into
Conversation
…label Digest-pinned images currently break the chart: the version label is built from image.tag, so a tag carrying @sha256:... renders an 88-character label containing @ and : and the API server rejects every object that includes permify.labels. The same expression also double-prefixes v (vv1.6.10) and has a dead .Chart.AppVersion fallback that renders a bare "v" on default values. Adds an image.digest value so digests replace the tag in the rendered image reference (permify.image), and derives the version label through a new permify.versionLabel helper that strips any inline digest, truncates to 63 characters, and validates against the Kubernetes label grammar before emitting it - falling back to .Chart.AppVersion, or omitting the label entirely, otherwise. No v prefix is prepended to user-provided tags. Verified with `helm template` across defaults, tag-only, tag+digest, digest-only, and legacy tag@digest values; every rendered app.kubernetes.io/version matches ^[A-Za-z0-9]([-_.A-Za-z0-9]*[A-Za-z0-9])?$ and stays under 63 characters, and `helm lint` passes.
eightseventhreethree
marked this pull request as ready for review
July 30, 2026 21:32
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Digest-pinned images currently break the chart: the version label is built from image.tag, so a tag carrying @sha256:... renders an 88-character label containing @ and : and the API server rejects every object that includes permify.labels. The same expression also double-prefixes v (vv1.6.10) and has a dead .Chart.AppVersion fallback that renders a bare "v" on default values.
Adds an image.digest value so digests replace the tag in the rendered image reference (permify.image), and derives the version label through a new permify.versionLabel helper that strips any inline digest, truncates to 63 characters, and validates against the Kubernetes label grammar before emitting it - falling back to .Chart.AppVersion, or omitting the label entirely, otherwise. No v prefix is prepended to user-provided tags.
Verified with
helm templateacross defaults, tag-only, tag+digest, digest-only, and legacy tag@digest values; every rendered app.kubernetes.io/version matches ^A-Za-z0-9?$ and stays under 63 characters, andhelm lintpasses.