# Specifying image sha, rather than tag, in helm chart

**URL:** <https://linkerd.buoyant.io/t/specifying-image-sha-rather-than-tag-in-helm-chart/229>\
**Category:** Linkerd General Discussion\
**Tags:** configuration\
**Created:** [August 16, 2023, 11:46pm UTC](https://linkerd.buoyant.io/t/specifying-image-sha-rather-than-tag-in-helm-chart/229 "2023-08-16T23:46:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![neal](https://yyz1.discourse-cdn.com/flex029/user_avatar/linkerd.buoyant.io/neal/32/54_2.png) [@neal](https://linkerd.buoyant.io/u/neal)\
**Post date:** [August 16, 2023, 11:46pm UTC](https://linkerd.buoyant.io/t/specifying-image-sha-rather-than-tag-in-helm-chart/229/1 "2023-08-16T23:46:54Z")

</div>

We use Linkerd in our GKE cluster, and prefer to use GCP’s binary authorization product to control which software runs there. Right now, we’ve added an image path pattern to the Binary authorization exemption list, because we can’t figure out how to to change the helm chart’s values.yml file to use an image digest rather than a tag. For example, we want to use image.url/some/path/image@sha256: 3d056213495816b57e58df9cdfec0302d289cecb29d8747fab38ee6afa143162, and _not_ image.url/some/path/image:v1.0.

It looks like most components _do_ actually allow specifying the version in values.yml, eg [here](https://github.com/linkerd/linkerd2/blob/main/charts/linkerd-control-plane/values.yaml#L72), we haven’t figured out whether there’s a supported path for setting the version for `controllerImage`. It seems to be configured slightly differently in the helm chart ([here](https://github.com/linkerd/linkerd2/blob/main/charts/linkerd-control-plane/values.yaml#L287-L292)).

Does anyone know how to achieve what I’m describing?

---

<div class="post-metadata">

**Author:** ![alpeb](https://yyz1.discourse-cdn.com/flex029/user_avatar/linkerd.buoyant.io/alpeb/32/61_2.png) [@alpeb](https://linkerd.buoyant.io/u/alpeb)\
**Post date:** [August 17, 2023, 7:07pm UTC](https://linkerd.buoyant.io/t/specifying-image-sha-rather-than-tag-in-helm-chart/229/2 "2023-08-17T19:07:42Z")

</div>

The controller image version is set to `.Values.linkerdVersion`. But you’re right, we should add some flexibility there to override with something else. As for the other images, if I understood correctly, would it work if you set for example `image.name=image.url/some/path/image@sha256` and `image.version=3d056213495816b57e58df9cdfec0302d289cecb29d8747fab38ee6afa143162`?

---

<div class="post-metadata">

**Author:** ![neal](https://yyz1.discourse-cdn.com/flex029/user_avatar/linkerd.buoyant.io/neal/32/54_2.png) [@neal](https://linkerd.buoyant.io/u/neal)\
**Post date:** [August 17, 2023, 10:44pm UTC](https://linkerd.buoyant.io/t/specifying-image-sha-rather-than-tag-in-helm-chart/229/3 "2023-08-17T22:44:36Z")

</div>

Yes, I think that works for the other images.

I hope there are no other unintended consequences of setting those that way?

---

<div class="post-metadata">

**Author:** ![alpeb](https://yyz1.discourse-cdn.com/flex029/user_avatar/linkerd.buoyant.io/alpeb/32/61_2.png) [@alpeb](https://linkerd.buoyant.io/u/alpeb)\
**Post date:** [August 18, 2023, 5:37pm UTC](https://linkerd.buoyant.io/t/specifying-image-sha-rather-than-tag-in-helm-chart/229/4 "2023-08-18T17:37:09Z")

</div>

I believe those image names aren’t used for anything else besides the `image` field in the workload manifests, so there shouldn’t be any unintended consequences. I’ve opened an [issue](https://github.com/linkerd/linkerd2/issues/11269) to tackle the controller tag parametrization.