Add optional tag support for Docker images in Helm charts

[Copilot]

Purpose

Helm charts only supported image digest references, forcing users to hardcode SHA256 hashes even for simple deployments. This adds optional tag support while maintaining digest priority for production use.

Goals

Enable flexible image specification:

• Tag-based references for development/testing workflows
• Digest-based references for immutable production deployments
• Graceful fallback when neither is specified

Approach

Added tag field to all chart values.yaml files and implemented conditional image reference in deployment templates:

# values.yaml
wso2:
  deployment:
    image:
      registry: "docker.io"
      repository: "wso2/wso2am"
      tag: "4.3.0"        # new field
      digest: ""

{{- if .Values.wso2.deployment.image.digest }}
image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }}
{{- else if .Values.wso2.deployment.image.tag }}
image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}:{{ .Values.wso2.deployment.image.tag }}
{{- else }}
image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}
{{- end }}

Charts updated:

• all-in-one
• distributed/gateway
• distributed/control-plane
• distributed/traffic-manager
• distributed/key-manager

Priority: digest > tag > latest

User stories

• DevOps engineer can deploy using version tags without maintaining digest lookups
• Production deployments continue using digests for immutability
• CI/CD pipelines can parameterize tag vs digest based on environment

Release note

Helm charts now support optional image.tag field alongside existing image.digest. Digest takes precedence when both are specified. Fully backward compatible.

Documentation

N/A - Auto-generated chart READMEs updated via helm-docs. No separate documentation required for values.yaml additions.

Training

N/A - Existing Helm deployment training covers image configuration.

Certification

N/A - Values file configuration change, not a product feature.

Marketing

N/A

Automation tests

• Unit tests: N/A (Helm chart configuration)
• Integration tests: Validated with helm template and helm lint across all charts

Security checks

• Followed secure coding standards
• Ran security scan - no vulnerabilities detected
• No secrets committed

Samples

# Using tag
helm install apim ./all-in-one \
  --set wso2.deployment.image.tag=4.3.0

# Using digest (production)
helm install apim ./all-in-one \
  --set wso2.deployment.image.digest=sha256:abc123...

Related PRs

N/A

Migrations

Backward compatible - no migration required. Existing digest-based deployments continue unchanged.

Test environment

• Helm 3.x
• Validated on all 5 chart types with multiple image reference combinations

Learning

Kubernetes best practices: digest for immutability, tags for development velocity. Implementation follows standard Helm conditional templating patterns.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}