feat(netbird-proxy-services): roll the PROXY-protocol build (2/2)

Pins the controller image by digest. The registry tag is the build date and pipeline 8452 rebuilt today's tag in place, so the tag alone cannot carry a new build to the cluster; the digest can. Merge only after the Traefik change from 1/2 has reconciled: from this build on every service target sends a PROXY protocol v2 header, and Traefik drops such connections unless websecure trusts the pod CIDRs. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-07 13:32:06 +02:00
1 changed files with 3 additions and 1 deletions
@@ -76,7 +76,9 @@ spec:
          type: RuntimeDefault
      containers:
        - name: controller
-          image: gitea.renner.uno/gitea_admin/netbird-proxy-services:2026-09-07
+          # Pinned by digest: the date tag is rebuilt on every push of the
+          # image directory, so the tag alone cannot express a new build.
+          image: gitea.renner.uno/gitea_admin/netbird-proxy-services:2026-09-07@sha256:0d266b0288aec692c698ff5c05f76c826e247bfef365e0306a0b9a6541ebf180
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true