Bump firewall image to 2.1.1 (Helm + CloudFormation)

[Eric Hibbs (flowstate)]

LLM Description written by Cursor:opus-5

What & why

Pins the customer-facing deployment artifacts to firewall image 2.1.1 and the Helm chart version to 0.11.2. main was still on 2.0.14, so this crosses four releases; the one that motivates shipping it now is 2.1.1, which fixes a failure specific to this chart's own hardening. The chart mounts the TLS secret at /etc/nginx/ssl read-only, and the config tool wrote its combined CA bundle into that same directory. The write failed, the failure was swallowed and then contradicted by a success log line, and startup continued on operating-system roots alone — so a deployment configuring a private CA for Redis TLS lost it silently and failed every handshake. 2.1.1 writes the bundle to /app/ca-bundle.pem instead.

Supersedes #22, which bumped to 2.1.0 and claimed the same chart version.

How it works

Nine version strings across six files, the same set #21 touched. Chart.yaml appVersion is the real source of truth — _helpers.tpl falls back to it — but values.yaml, the CloudFormation parameter defaults, the example values file, and both READMEs each carry their own copy that has to be moved in lockstep.

No chart template changes, hence a patch chart bump rather than a minor.

What to look at first

That helm/Chart.yaml appVersion and the FirewallImageTag default in cloudformation/firewall-eks.yaml agree. The CloudFormation parameter is a separate pin by design (so stacks don't drift when the chart's appVersion moves independently), which also means nothing enforces that the two match.

Testing

helm lint passes, and helm template renders socketdev/socket-registry-firewall:2.1.1 with app.kubernetes.io/version: "2.1.1". Grepping the tree for the old 2.0.14 and 0.11.1 strings returns nothing.

The image itself is not exercised here.

Notes

Merging this publishes chart 0.11.2 to the public Helm repo immediately — the release workflow fires on any helm/Chart.yaml change to main. So this should not merge until the 2.1.1 image is on Docker Hub, or the published chart will point at a tag that cannot be pulled.

metrics.minImageVersion stays at 1.1.343. It is a floor for gating the metrics endpoint, not a pin, and 2.1.1 clears it.

---

Note

Low Risk
Version-string and documentation updates only; no runtime logic or chart template changes, though merging publishes chart 0.11.2 and assumes the 2.1.1 image is pullable.

Overview
Pins customer-facing deployment artifacts to firewall image 2.1.1 and bumps the Helm chart version to 0.11.2 (patch only—no template changes).

Helm: Chart.yaml appVersion moves to 2.1.1; helm/values.yaml and helm/README.md default image.tag documentation match. CloudFormation EKS: firewall-eks.yaml defaults for ChartVersion (0.11.2) and FirewallImageTag (2.1.1), plus values/dns-override.values.yaml and cloudformation/README.md prose, stay in lockstep with the chart pins.

Shipping 2.1.1 matters for Helm hardening: the image no longer writes a combined CA bundle into the read-only TLS mount (/etc/nginx/ssl), which could silently drop private Redis CA trust; the bundle is written under /app/ca-bundle.pem instead.

^{Reviewed by Cursor Bugbot for commit 5166e32. Configure here.}