From 89bea274de50f302ace5c78f3d89a2543838f241 Mon Sep 17 00:00:00 2001 From: "promptless[bot]" Date: Fri, 22 May 2026 10:49:32 +0000 Subject: [PATCH] docs: add digest field for OCI chart dependencies Document the new digest field for Chart.yaml dependencies, which allows specifying SHA256 digests for OCI-based chart dependencies instead of relying on mutable version tags. Signed-off-by: promptless[bot] --- docs/topics/charts.mdx | 1 + docs/topics/registries.mdx | 22 +++++++++++++++++++++- 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/docs/topics/charts.mdx b/docs/topics/charts.mdx index f9fdd55a89..80be8ecec0 100644 --- a/docs/topics/charts.mdx +++ b/docs/topics/charts.mdx @@ -67,6 +67,7 @@ dependencies: # A list of the chart requirements (optional) - name: The name of the chart (nginx) version: The version of the chart ("1.2.3") repository: (optional) The repository URL ("https://example.com/charts") or alias ("@repo-name") + digest: (optional) The SHA256 digest for OCI dependencies, used instead of version tag for immutable references condition: (optional) A yaml path that resolves to a boolean, used for enabling/disabling charts (e.g. subchart1.enabled ) tags: # (optional) - Tags can be used to group charts for enabling/disabling together diff --git a/docs/topics/registries.mdx b/docs/topics/registries.mdx index 6df50eb759..c853b0ed56 100644 --- a/docs/topics/registries.mdx +++ b/docs/topics/registries.mdx @@ -185,7 +185,7 @@ Dependencies of a chart can be pulled from a registry using the `dependency upda The `repository` for a given entry in `Chart.yaml` is specified as the registry reference without the basename: -``` +```yaml dependencies: - name: mychart version: "2.7.0" @@ -193,6 +193,26 @@ dependencies: ``` This will fetch `oci://localhost:5000/myrepo/mychart:2.7.0` when `dependency update` is executed. +### Specifying dependencies with digest + +You can specify a SHA256 digest instead of relying on version tags. Digests are immutable, so they provide stronger guarantees that you get the exact chart artifact you expect. When a `digest` is specified, Helm fetches the dependency using the digest rather than the version tag: + +```yaml +dependencies: + - name: mychart + version: "2.7.0" + repository: "oci://localhost:5000/myrepo" + digest: "sha256:ec5f08ee7be8b557cd1fc5ae1a0ac985e8538da7c93f51a51eff4b277509a723" +``` + +This will fetch `oci://localhost:5000/myrepo/mychart@sha256:ec5f08ee7be8b557cd1fc5ae1a0ac985e8538da7c93f51a51eff4b277509a723` when `dependency update` is executed. + +Because digests are immutable, they are useful for: + +- **Reproducible builds**: The same dependency content is used across different environments +- **Supply chain security**: Version tags cannot be overwritten to point to different content +- **Audit compliance**: An exact record of which artifacts were deployed + ## Helm chart manifest Example Helm chart manifest as represented in a registry