From a7d27abb1aa32a9ecddd985c1c8b90a95149214d Mon Sep 17 00:00:00 2001 From: Ruxandra Fediuc Date: Wed, 19 Aug 2026 15:57:50 -0700 Subject: [PATCH 1/2] chore: remove telemetry_enabled config knob The firewall no longer exposes a telemetry opt-out (SocketDev/socket-nginx-firewall#368), so drop telemetryEnabled from the Helm values + configmap template and the CloudFormation dns-override values. Telemetry is now unconditionally on. --- cloudformation/values/dns-override.values.yaml | 1 - helm/templates/configmap.yaml | 1 - helm/values.yaml | 2 -- 3 files changed, 4 deletions(-) diff --git a/cloudformation/values/dns-override.values.yaml b/cloudformation/values/dns-override.values.yaml index 1a49c83..57a1f9c 100644 --- a/cloudformation/values/dns-override.values.yaml +++ b/cloudformation/values/dns-override.values.yaml @@ -29,7 +29,6 @@ socket: useRemoteConfig: false configRefreshInterval: "60s" bearerTokenType: "string" - telemetryEnabled: true saveIgnoreReason: false requestIdHeader: "X-Socket-Request-ID" exposeUnscannedHeader: false diff --git a/helm/templates/configmap.yaml b/helm/templates/configmap.yaml index 50f09ae..bfa319f 100644 --- a/helm/templates/configmap.yaml +++ b/helm/templates/configmap.yaml @@ -44,7 +44,6 @@ data: {{- if .Values.socket.healthApiToken }} health_api_token: {{ .Values.socket.healthApiToken | quote }} {{- end }} - telemetry_enabled: {{ .Values.socket.telemetryEnabled }} save_ignore_reason: {{ .Values.socket.saveIgnoreReason }} request_id_header: {{ .Values.socket.requestIdHeader | quote }} expose_unscanned_header: {{ .Values.socket.exposeUnscannedHeader }} diff --git a/helm/values.yaml b/helm/values.yaml index af11273..839c95d 100644 --- a/helm/values.yaml +++ b/helm/values.yaml @@ -58,8 +58,6 @@ socket: # with bearerToken; use this to avoid putting the token in values) bearerTokenExistingSecret: "" bearerTokenExistingSecretKey: "SOCKET_BEARER_TOKEN" - # Send usage/decision telemetry to Socket (batched /v1 events endpoint) - telemetryEnabled: true # Include ignore_reason in decision events sent to telemetry/webhook/splunk saveIgnoreReason: false # Header echoed in logs/telemetry for request correlation From 66c51d5b8ee247cbbfa01a2b6211aadd080df03e Mon Sep 17 00:00:00 2001 From: Ruxandra Fediuc Date: Wed, 19 Aug 2026 16:50:05 -0700 Subject: [PATCH 2/2] chore: bump firewall image to 2.2.0 (Helm + CloudFormation) Chart appVersion 2.1.1 -> 2.2.0, chart version 0.11.2 -> 0.11.3, and the CloudFormation FirewallImageTag/ChartVersion defaults + doc references. The 2.2.0 image ignores telemetry_enabled, so this pairs with the knob removal in this PR. --- cloudformation/README.md | 4 ++-- cloudformation/firewall-eks.yaml | 4 ++-- cloudformation/values/dns-override.values.yaml | 2 +- helm/Chart.yaml | 4 ++-- helm/README.md | 2 +- helm/values.yaml | 2 +- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/cloudformation/README.md b/cloudformation/README.md index 3796995..deda687 100644 --- a/cloudformation/README.md +++ b/cloudformation/README.md @@ -14,7 +14,7 @@ On EKS the firewall is the **Helm chart** (`../helm`), which already supports DN |------|---------| | `eks-cluster.yaml` | **Greenfield wrapper** — VPC + EKS cluster + node group + OIDC provider. Skip if you already run a cluster. | | `firewall-eks.yaml` | **Shared base** — ElastiCache Redis + Socket token (Secrets Manager) + IRSA role; emits the `helm upgrade --install` command. | -| `values/dns-override.values.yaml` | Example Helm values (DNS-override + Redis + self-signed certs). Behavioral defaults stay synced with `helm/values.yaml`; image pinned to `2.1.1`. | +| `values/dns-override.values.yaml` | Example Helm values (DNS-override + Redis + self-signed certs). Behavioral defaults stay synced with `helm/values.yaml`; image pinned to `2.2.0`. | ## Cases @@ -29,7 +29,7 @@ The base template currently takes the **handoff** approach: CloudFormation provi ## Config model -On EKS the Helm chart renders the firewall config into a **ConfigMap**. The stack injects install-time values for the ElastiCache endpoint (`redis.host`), the Socket token (`socket.apiToken`, read from Secrets Manager), and the firewall image tag (`image.tag`, default `2.1.1`). Chart version defaults to `0.11.2`. +On EKS the Helm chart renders the firewall config into a **ConfigMap**. The stack injects install-time values for the ElastiCache endpoint (`redis.host`), the Socket token (`socket.apiToken`, read from Secrets Manager), and the firewall image tag (`image.tag`, default `2.2.0`). Chart version defaults to `0.11.3`. ## Known DRAFT caveats diff --git a/cloudformation/firewall-eks.yaml b/cloudformation/firewall-eks.yaml index 9d43679..e1eff2a 100644 --- a/cloudformation/firewall-eks.yaml +++ b/cloudformation/firewall-eks.yaml @@ -54,12 +54,12 @@ Parameters: ChartVersion: Type: String - Default: "0.11.2" + Default: "0.11.3" Description: Socket Firewall Helm chart version to install. FirewallImageTag: Type: String - Default: "2.1.1" + Default: "2.2.0" Description: socketdev/socket-registry-firewall image tag (must match chart appVersion). Resources: diff --git a/cloudformation/values/dns-override.values.yaml b/cloudformation/values/dns-override.values.yaml index 57a1f9c..0713c30 100644 --- a/cloudformation/values/dns-override.values.yaml +++ b/cloudformation/values/dns-override.values.yaml @@ -17,7 +17,7 @@ image: repository: socketdev/socket-registry-firewall # Pin explicitly so CloudFormation installs don't drift if the chart # appVersion changes independently. Never use :latest for a security product. - tag: "2.1.1" + tag: "2.2.0" pullPolicy: Always socket: diff --git a/helm/Chart.yaml b/helm/Chart.yaml index a7220fd..858ad72 100644 --- a/helm/Chart.yaml +++ b/helm/Chart.yaml @@ -2,10 +2,10 @@ apiVersion: v2 name: socket-firewall description: Socket.dev Registry Firewall - Block vulnerable packages before they reach your cluster type: application -version: 0.11.2 +version: 0.11.3 # appVersion is the single source of truth for the firewall image version. # image.tag in values.yaml defaults to this (see templates/_helpers.tpl). -appVersion: "2.1.1" +appVersion: "2.2.0" keywords: - security - supply-chain diff --git a/helm/README.md b/helm/README.md index e0b6441..efe21dd 100644 --- a/helm/README.md +++ b/helm/README.md @@ -90,7 +90,7 @@ registries: | Parameter | Description | Default | |-----------|-------------|---------| | `image.repository` | Docker image | `socketdev/socket-registry-firewall` | -| `image.tag` | Image tag. Keep in sync with chart `appVersion`. Empty falls back to `appVersion`. | `"2.1.1"` | +| `image.tag` | Image tag. Keep in sync with chart `appVersion`. Empty falls back to `appVersion`. | `"2.2.0"` | | `image.pullPolicy` | Image pull policy | `Always` | | `replicaCount` | Number of replicas (ignored if autoscaling enabled) | `1` | | `socket.apiToken` | Socket API token | `""` | diff --git a/helm/values.yaml b/helm/values.yaml index 839c95d..f8e59d2 100644 --- a/helm/values.yaml +++ b/helm/values.yaml @@ -5,7 +5,7 @@ image: repository: socketdev/socket-registry-firewall # Keep in sync with Chart.yaml appVersion. Leave empty only if you intentionally # want to track whatever appVersion the installed chart carries. - tag: "2.1.1" + tag: "2.2.0" pullPolicy: Always # Image pull secrets for private registries