Setting `fsGroup` without a change policy leaves Kubernetes on its default of
`Always`, which walks the whole volume and chowns every file each time the pod
starts. On an instance with a few thousand attachments that turns every
restart into a wait, and a slow enough one fails the readiness probe.
`OnRootMismatch` checks the top directory and stops there when it already
matches, so an existing volume pays the walk once.
* feat(helm): add image digest field to values
- Add optional 'digest' field under image.repository configuration
- Allows users to pin container images by SHA256 digest
- Improves security through immutable image identification
- Fully backward compatible (digest is optional)
* feat(helm): implement image digest pinning in deployment template
- Add conditional logic to support SHA256 digest in image references
- When digest is set with tag: generates 'repository:tag@sha256:digest'
- When digest is set without tag: generates 'repository@sha256:digest'
- Preserves backward compatibility with tag-only deployments
- Validates tag presence to avoid invalid image references
* docs(helm): add image digest pinning documentation
- Add 'Image Digest Pinning' section under Advanced Configuration
- Include methods for finding image digests (docker inspect, skopeo)
- Document two usage options:
- Option 1: Digest with tag (recommended) for reference + verification
- Option 2: Digest only for minimalist configuration
- Explain security benefits (immutability, supply chain security, reproducibility)
- Provide complete helm and values.yaml examples
Daniel Hiller