[INF-7468] Allow busybox init image override

charts/retool/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: retool
 description: A Helm chart for Kubernetes
 type: application
-version: 6.11.12
+version: 6.11.13
 maintainers:
   - name: Retool Engineering
     email: engineering+helm@retool.com

charts/retool/templates/_helpers.tpl

@@ -1128,6 +1128,16 @@ Two classes of stale config are caught:
 {{- end -}}
 {{- end -}}
 
+{{/*
+Render the seccomp-install initContainer image reference.
+Usage: (include "retool.initImage" .)
+*/}}
+{{- define "retool.initImage" -}}
+{{- $i := .Values.initImage -}}
+{{- printf "%s:%s" $i.repository (toString $i.tag) -}}
+{{- if $i.digest }}@{{ $i.digest }}{{ end -}}
+{{- end -}}
+
 {{/*
 Set code executor image tag
 Usage: (template "retool.codeExecutor.image.tag" .)

charts/retool/templates/deployment_code_executor.yaml

@@ -57,7 +57,7 @@ spec:
       initContainers:
 {{- if $useSecComp }}
         - name: install-seccomp
-          image: busybox:1.37.0@sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f
+          image: {{ include "retool.initImage" . }}
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

charts/retool/templates/deployment_js_executor.yaml

@@ -48,7 +48,7 @@ spec:
       {{- end }}
       initContainers:
         - name: install-seccomp
-          image: busybox:1.37.0@sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f
+          image: {{ include "retool.initImage" . }}
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

charts/retool/values.yaml

@@ -55,6 +55,18 @@ image:
   tag: ""
   pullPolicy: "IfNotPresent"
 
+# Small utility image for the initContainers that install the nsjail seccomp
+# profile onto the host, on the code executor and JS executor. Only used when
+# seccomp is in play.
+#
+# Override repository if every image has to come from one registry -- a private
+# mirror, an air-gapped install, or GCP Marketplace, which rejects any artifact
+# a consumer pulls from outside its own Artifact Registry.
+initImage:
+  repository: busybox
+  tag: '1.37.0'
+  digest: 'sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f'
+
 commandline:
   args: []