From c9cac322c30b38d5f5b9c8d45966b2a02268c3be Mon Sep 17 00:00:00 2001 From: Eric Hibbs Date: Tue, 25 Aug 2026 13:06:55 -0700 Subject: [PATCH] Bump firewall image to 2.3.3 (Helm + CloudFormation) Chart appVersion 2.2.0 -> 2.3.3, chart version 0.11.3 -> 0.11.4, and the CloudFormation FirewallImageTag/ChartVersion defaults + doc references. --- cloudformation/README.md | 4 ++-- cloudformation/firewall-eks.yaml | 4 ++-- cloudformation/values/dns-override.values.yaml | 2 +- helm/Chart.yaml | 4 ++-- helm/README.md | 2 +- helm/values.yaml | 2 +- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/cloudformation/README.md b/cloudformation/README.md index deda687..053a214 100644 --- a/cloudformation/README.md +++ b/cloudformation/README.md @@ -14,7 +14,7 @@ On EKS the firewall is the **Helm chart** (`../helm`), which already supports DN |------|---------| | `eks-cluster.yaml` | **Greenfield wrapper** — VPC + EKS cluster + node group + OIDC provider. Skip if you already run a cluster. | | `firewall-eks.yaml` | **Shared base** — ElastiCache Redis + Socket token (Secrets Manager) + IRSA role; emits the `helm upgrade --install` command. | -| `values/dns-override.values.yaml` | Example Helm values (DNS-override + Redis + self-signed certs). Behavioral defaults stay synced with `helm/values.yaml`; image pinned to `2.2.0`. | +| `values/dns-override.values.yaml` | Example Helm values (DNS-override + Redis + self-signed certs). Behavioral defaults stay synced with `helm/values.yaml`; image pinned to `2.3.3`. | ## Cases @@ -29,7 +29,7 @@ The base template currently takes the **handoff** approach: CloudFormation provi ## Config model -On EKS the Helm chart renders the firewall config into a **ConfigMap**. The stack injects install-time values for the ElastiCache endpoint (`redis.host`), the Socket token (`socket.apiToken`, read from Secrets Manager), and the firewall image tag (`image.tag`, default `2.2.0`). Chart version defaults to `0.11.3`. +On EKS the Helm chart renders the firewall config into a **ConfigMap**. The stack injects install-time values for the ElastiCache endpoint (`redis.host`), the Socket token (`socket.apiToken`, read from Secrets Manager), and the firewall image tag (`image.tag`, default `2.3.3`). Chart version defaults to `0.11.4`. ## Known DRAFT caveats diff --git a/cloudformation/firewall-eks.yaml b/cloudformation/firewall-eks.yaml index e1eff2a..fa61e78 100644 --- a/cloudformation/firewall-eks.yaml +++ b/cloudformation/firewall-eks.yaml @@ -54,12 +54,12 @@ Parameters: ChartVersion: Type: String - Default: "0.11.3" + Default: "0.11.4" Description: Socket Firewall Helm chart version to install. FirewallImageTag: Type: String - Default: "2.2.0" + Default: "2.3.3" Description: socketdev/socket-registry-firewall image tag (must match chart appVersion). Resources: diff --git a/cloudformation/values/dns-override.values.yaml b/cloudformation/values/dns-override.values.yaml index 0713c30..b46410a 100644 --- a/cloudformation/values/dns-override.values.yaml +++ b/cloudformation/values/dns-override.values.yaml @@ -17,7 +17,7 @@ image: repository: socketdev/socket-registry-firewall # Pin explicitly so CloudFormation installs don't drift if the chart # appVersion changes independently. Never use :latest for a security product. - tag: "2.2.0" + tag: "2.3.3" pullPolicy: Always socket: diff --git a/helm/Chart.yaml b/helm/Chart.yaml index 858ad72..9a39b68 100644 --- a/helm/Chart.yaml +++ b/helm/Chart.yaml @@ -2,10 +2,10 @@ apiVersion: v2 name: socket-firewall description: Socket.dev Registry Firewall - Block vulnerable packages before they reach your cluster type: application -version: 0.11.3 +version: 0.11.4 # appVersion is the single source of truth for the firewall image version. # image.tag in values.yaml defaults to this (see templates/_helpers.tpl). -appVersion: "2.2.0" +appVersion: "2.3.3" keywords: - security - supply-chain diff --git a/helm/README.md b/helm/README.md index efe21dd..0af7e04 100644 --- a/helm/README.md +++ b/helm/README.md @@ -90,7 +90,7 @@ registries: | Parameter | Description | Default | |-----------|-------------|---------| | `image.repository` | Docker image | `socketdev/socket-registry-firewall` | -| `image.tag` | Image tag. Keep in sync with chart `appVersion`. Empty falls back to `appVersion`. | `"2.2.0"` | +| `image.tag` | Image tag. Keep in sync with chart `appVersion`. Empty falls back to `appVersion`. | `"2.3.3"` | | `image.pullPolicy` | Image pull policy | `Always` | | `replicaCount` | Number of replicas (ignored if autoscaling enabled) | `1` | | `socket.apiToken` | Socket API token | `""` | diff --git a/helm/values.yaml b/helm/values.yaml index f8e59d2..4922590 100644 --- a/helm/values.yaml +++ b/helm/values.yaml @@ -5,7 +5,7 @@ image: repository: socketdev/socket-registry-firewall # Keep in sync with Chart.yaml appVersion. Leave empty only if you intentionally # want to track whatever appVersion the installed chart carries. - tag: "2.2.0" + tag: "2.3.3" pullPolicy: Always # Image pull secrets for private registries