From 78881e157d8f184865ed07403b31e0e65b12bc58 Mon Sep 17 00:00:00 2001 From: "promptless[bot]" Date: Fri, 24 Jul 2026 14:41:21 +0000 Subject: [PATCH 1/2] Document optional image.sha chart value for pinning the operator image by digest Adds a subsection to the Helm install page covering the new optional image.sha value (logging-operator PR #2280), which pins the operator image to a sha256 digest instead of a tag. --- content/docs/install/_index.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/content/docs/install/_index.md b/content/docs/install/_index.md index e687c1157..e38b3a497 100644 --- a/content/docs/install/_index.md +++ b/content/docs/install/_index.md @@ -137,6 +137,26 @@ cosign verify "ghcr.io/kube-logging/logging-operator@sha256:50550883905ffe484f21 --certificate-oidc-issuer "https://token.actions.githubusercontent.com" ``` +### Pin the operator image by digest {#pin-image-sha} + +The logging-operator Helm chart accepts an optional `image.sha` value that pins the operator image to a specific digest instead of a tag. It is unset by default, so omitting it keeps the chart's standard tag-based behavior and upgrades stay backward compatible. + +Pinning by digest is useful in two cases: + +- To pin a digest you just verified in the [image verification](#image-verification) step above, as an extra safeguard. +- To run a specific pre-release or `master` image by digest. For the tag-based alternative, see [How can I run the unreleased master version](/docs/faq/#how-can-i-run-the-unreleased-master-version). That approach uses `--set image.tag=master`. + +The value must include the full `sha256:` prefix. When set, the chart renders the operator image in digest form as `@`, for example `ghcr.io/kube-logging/logging-operator@sha256:...`. To set it, add `--set image.sha=` to the OCI install command. + +For example, using the 4.11.0 image digest (substitute the digest you verified): + +```shell +helm upgrade --install --wait --create-namespace --namespace logging logging-operator oci://ghcr.io/kube-logging/helm-charts/logging-operator \ + --set image.sha=sha256:50550883905ffe484f210ae65a8e0dbcbc0836c240b1fec454945d8b97830ede +``` + +> Note: When `image.sha` is set, it overrides both `image.tag` and the chart's appVersion. Setting a tag alongside it has no effect because the digest wins. + ### Chart verification You can verify our charts by running the following command. From a5a737530bdb81ca1e00eae91c19e58a73572b03 Mon Sep 17 00:00:00 2001 From: "promptless[bot]" Date: Tue, 28 Jul 2026 11:40:55 +0000 Subject: [PATCH 2/2] Rename chart value to image.digest per merged PR #2280 Reconcile the install-page 'Pin the operator image by digest' subsection to the value name that shipped in logging-operator PR #2280: the chart value merged as image.digest (renamed from the pre-merge image.sha). Also tighten the intro sentence and backtick appVersion. --- content/docs/install/_index.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/docs/install/_index.md b/content/docs/install/_index.md index e38b3a497..03e636430 100644 --- a/content/docs/install/_index.md +++ b/content/docs/install/_index.md @@ -137,25 +137,25 @@ cosign verify "ghcr.io/kube-logging/logging-operator@sha256:50550883905ffe484f21 --certificate-oidc-issuer "https://token.actions.githubusercontent.com" ``` -### Pin the operator image by digest {#pin-image-sha} +### Pin the operator image by digest {#pin-image-digest} -The logging-operator Helm chart accepts an optional `image.sha` value that pins the operator image to a specific digest instead of a tag. It is unset by default, so omitting it keeps the chart's standard tag-based behavior and upgrades stay backward compatible. +The logging-operator Helm chart accepts an optional `image.digest` value that pins the operator image to a specific digest instead of a tag. It is unset by default. Omitting it keeps the chart's standard tag-based behavior, so upgrades remain backward compatible. Pinning by digest is useful in two cases: - To pin a digest you just verified in the [image verification](#image-verification) step above, as an extra safeguard. - To run a specific pre-release or `master` image by digest. For the tag-based alternative, see [How can I run the unreleased master version](/docs/faq/#how-can-i-run-the-unreleased-master-version). That approach uses `--set image.tag=master`. -The value must include the full `sha256:` prefix. When set, the chart renders the operator image in digest form as `@`, for example `ghcr.io/kube-logging/logging-operator@sha256:...`. To set it, add `--set image.sha=` to the OCI install command. +The value must include the full `sha256:` prefix. When set, the chart renders the operator image in digest form as `@`, for example `ghcr.io/kube-logging/logging-operator@sha256:...`. To set it, add `--set image.digest=` to the OCI install command. For example, using the 4.11.0 image digest (substitute the digest you verified): ```shell helm upgrade --install --wait --create-namespace --namespace logging logging-operator oci://ghcr.io/kube-logging/helm-charts/logging-operator \ - --set image.sha=sha256:50550883905ffe484f210ae65a8e0dbcbc0836c240b1fec454945d8b97830ede + --set image.digest=sha256:50550883905ffe484f210ae65a8e0dbcbc0836c240b1fec454945d8b97830ede ``` -> Note: When `image.sha` is set, it overrides both `image.tag` and the chart's appVersion. Setting a tag alongside it has no effect because the digest wins. +> Note: When `image.digest` is set, it overrides both `image.tag` and the chart's `appVersion`. Setting a tag alongside it has no effect because the digest wins. ### Chart verification