developmentseed · pantierra · Jul 23, 2026 · Jul 23, 2026 · Jul 23, 2026
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.14.0"
+  ".": "0.14.1"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,20 @@
 # Changelog
 
+## [0.14.1](https://github.com/developmentseed/eoapi-k8s/compare/v0.14.0...v0.14.1) (2026-07-23)
+
+
+### Fixed
+
+* **docs:** updated release information. ([#571](https://github.com/developmentseed/eoapi-k8s/issues/571)) ([693cdb6](https://github.com/developmentseed/eoapi-k8s/commit/693cdb67cc7e1625220bd8cd143a256159abaf99))
+
+
+### Maintenance
+
+* bump minimal version of kubernetes to 1.32 ([#567](https://github.com/developmentseed/eoapi-k8s/issues/567)) ([be183e7](https://github.com/developmentseed/eoapi-k8s/commit/be183e78a152f55f1781ee76498bea875ba07a8c))
+* **deps:** updated actions/checkout digest to 3d3c42e ([#564](https://github.com/developmentseed/eoapi-k8s/issues/564)) ([d70a976](https://github.com/developmentseed/eoapi-k8s/commit/d70a97623edc33e0ff68237adae9f5b1892de6e8))
+* **deps:** updated helm release prometheus to 29.18.0. ([#565](https://github.com/developmentseed/eoapi-k8s/issues/565)) ([5d83768](https://github.com/developmentseed/eoapi-k8s/commit/5d83768feef31c479c4fc976f038a7e489427912))
+* **deps:** updated helm release prometheus to 29.19.0. ([#570](https://github.com/developmentseed/eoapi-k8s/issues/570)) ([88d305d](https://github.com/developmentseed/eoapi-k8s/commit/88d305d103a1c0d56fb7c785f14efed8c9cd27ff))
+
 ## [0.14.0](https://github.com/developmentseed/eoapi-k8s/compare/v0.13.4...v0.14.0) (2026-07-20)
 
 

diff --git a/charts/eoapi/Chart.yaml b/charts/eoapi/Chart.yaml
@@ -25,7 +25,7 @@ annotations:
     - stac
     - raster
     - vector
-version: 0.14.0
+version: 0.14.1
 appVersion: 6.3.1
 dependencies:
   - name: postgrescluster

diff --git a/charts/eoapi/profiles/experimental.yaml b/charts/eoapi/profiles/experimental.yaml
@@ -386,8 +386,8 @@ testing:
     enabled: true
     replicaCount: 1
     image:
-      repository: ghcr.io/alukach/mock-oidc-server
-      tag: latest
+      name: ghcr.io/alukach/mock-oidc-server
+      digest: sha256:5972adac0b6e3a094ea043be0f1851c65e3fd54e17a546f0b71dedd17c7a2d6a
       pullPolicy: IfNotPresent
     port: 8888
     clientId: "test-client"

diff --git a/charts/eoapi/templates/_helpers/core.tpl b/charts/eoapi/templates/_helpers/core.tpl
@@ -73,3 +73,15 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+Resolve a container image reference from an image values map.
+Uses name + tag, or name@digest when digest is set.
+*/}}
+{{- define "eoapi.containerImage" -}}
+{{- if .digest -}}
+{{- printf "%s@%s" .name .digest -}}
+{{- else -}}
+{{- printf "%s:%s" .name (required "image.tag is required when digest is unset" .tag) -}}
+{{- end -}}
+{{- end -}}
diff --git a/charts/eoapi/templates/_helpers/services.tpl b/charts/eoapi/templates/_helpers/services.tpl
@@ -43,7 +43,8 @@ Helper function for common init containers to wait for pgstac jobs
 {{- if .Values.pgstacBootstrap.enabled }}
 initContainers:
 - name: wait-for-pgstac-jobs
-  image: alpine/kubectl:1.34.1
+  image: {{ include "eoapi.containerImage" .Values.pgstacBootstrap.waitImage }}
+  imagePullPolicy: {{ .Values.pgstacBootstrap.waitImage.pullPolicy | default "IfNotPresent" }}
   securityContext:
     runAsNonRoot: true
     runAsUser: 65534

diff --git a/charts/eoapi/templates/core/cloudevents-sink.yaml b/charts/eoapi/templates/core/cloudevents-sink.yaml
@@ -29,7 +29,8 @@ spec:
     spec:
       containers:
       - name: cloudevents-sink
-        image: gcr.io/knative-samples/helloworld-go:latest
+        image: {{ include "eoapi.containerImage" .Values.knative.cloudEventsSink.image }}
+        imagePullPolicy: {{ .Values.knative.cloudEventsSink.image.pullPolicy | default "IfNotPresent" }}
         ports:
         - containerPort: 8080
         env:

diff --git a/charts/eoapi/templates/core/knative-init.yaml b/charts/eoapi/templates/core/knative-init.yaml
@@ -22,8 +22,8 @@ spec:
       serviceAccountName: {{ include "eoapi.serviceAccountName" . }}
       containers:
       - name: knative-init
-        image: alpine/kubectl:1.34.1
-        imagePullPolicy: IfNotPresent
+        image: {{ include "eoapi.containerImage" .Values.knative.jobs.init.image }}
+        imagePullPolicy: {{ .Values.knative.jobs.init.image.pullPolicy | default "IfNotPresent" }}
         securityContext:
           runAsNonRoot: true
           runAsUser: 65534

diff --git a/charts/eoapi/templates/database/pgstacbootstrap/eoap-superuser-initdb.yaml b/charts/eoapi/templates/database/pgstacbootstrap/eoap-superuser-initdb.yaml
@@ -22,7 +22,8 @@ spec:
       restartPolicy: Never
       containers:
         - name: pgstac-eoapiuser-permissions
-          image: {{ .Values.pgstacBootstrap.image.name }}:{{ .Values.pgstacBootstrap.image.tag }}
+          image: {{ include "eoapi.containerImage" .Values.pgstacBootstrap.image }}
+          imagePullPolicy: {{ .Values.pgstacBootstrap.image.pullPolicy | default "IfNotPresent" }}
           command:
             - "/bin/sh"
             - "-c"

diff --git a/charts/eoapi/templates/database/pgstacbootstrap/extent-updater.yaml b/charts/eoapi/templates/database/pgstacbootstrap/extent-updater.yaml
@@ -25,8 +25,8 @@ spec:
           restartPolicy: OnFailure
           containers:
           - name: extent-updater
-            image: {{ .Values.pgstacBootstrap.image.name }}:{{ .Values.pgstacBootstrap.image.tag }}
-            imagePullPolicy: IfNotPresent
+            image: {{ include "eoapi.containerImage" .Values.pgstacBootstrap.image }}
+            imagePullPolicy: {{ .Values.pgstacBootstrap.image.pullPolicy | default "IfNotPresent" }}
             command:
               - "/bin/sh"
               - "-c"

diff --git a/charts/eoapi/templates/database/pgstacbootstrap/job.yaml b/charts/eoapi/templates/database/pgstacbootstrap/job.yaml
@@ -39,7 +39,8 @@ spec:
       restartPolicy: Never
       containers:
         - name: pgstac-migrate
-          image: {{ .Values.pgstacBootstrap.image.name }}:{{ .Values.pgstacBootstrap.image.tag }}
+          image: {{ include "eoapi.containerImage" .Values.pgstacBootstrap.image }}
+          imagePullPolicy: {{ .Values.pgstacBootstrap.image.pullPolicy | default "IfNotPresent" }}
           command:
             - "/bin/sh"
             - "-c"
@@ -107,7 +108,8 @@ spec:
       restartPolicy: Never
       containers:
         - name: pgstac-load-samples
-          image: {{ .Values.pgstacBootstrap.image.name }}:{{ .Values.pgstacBootstrap.image.tag }}
+          image: {{ include "eoapi.containerImage" .Values.pgstacBootstrap.image }}
+          imagePullPolicy: {{ .Values.pgstacBootstrap.image.pullPolicy | default "IfNotPresent" }}
           command:
             - "/bin/sh"
             - "-c"
@@ -178,7 +180,8 @@ spec:
       restartPolicy: Never
       containers:
         - name: pgstac-load-queryables
-          image: {{ .Values.pgstacBootstrap.image.name }}:{{ .Values.pgstacBootstrap.image.tag }}
+          image: {{ include "eoapi.containerImage" .Values.pgstacBootstrap.image }}
+          imagePullPolicy: {{ .Values.pgstacBootstrap.image.pullPolicy | default "IfNotPresent" }}
           command:
             - "/bin/sh"
             - "-c"

diff --git a/charts/eoapi/templates/database/pgstacbootstrap/queue-processor.yaml b/charts/eoapi/templates/database/pgstacbootstrap/queue-processor.yaml
@@ -25,8 +25,8 @@ spec:
           restartPolicy: OnFailure
           containers:
           - name: queue-processor
-            image: {{ .Values.pgstacBootstrap.image.name }}:{{ .Values.pgstacBootstrap.image.tag }}
-            imagePullPolicy: IfNotPresent
+            image: {{ include "eoapi.containerImage" .Values.pgstacBootstrap.image }}
+            imagePullPolicy: {{ .Values.pgstacBootstrap.image.pullPolicy | default "IfNotPresent" }}
             command:
               - "/bin/sh"
               - "-c"

diff --git a/charts/eoapi/templates/services/browser/deployment.yaml b/charts/eoapi/templates/services/browser/deployment.yaml
@@ -21,7 +21,8 @@ spec:
     spec:
       containers:
         - name: browser
-          image: {{ .Values.browser.image.name }}:{{ .Values.browser.image.tag }}
+          image: {{ include "eoapi.containerImage" .Values.browser.image }}
+          imagePullPolicy: {{ .Values.browser.image.pullPolicy | default "IfNotPresent" }}
           ports:
           - containerPort: 8080
           env:

diff --git a/charts/eoapi/templates/services/doc-server.yaml b/charts/eoapi/templates/services/doc-server.yaml
@@ -51,7 +51,8 @@ spec:
     spec:
       containers:
       - name: doc-server
-        image: nginxinc/nginx-unprivileged:alpine
+        image: {{ include "eoapi.containerImage" .Values.docServer.image }}
+        imagePullPolicy: {{ .Values.docServer.image.pullPolicy | default "IfNotPresent" }}
         volumeMounts:
         - name: {{ .Release.Name }}-doc-html
           mountPath: /usr/share/nginx/html

diff --git a/charts/eoapi/templates/services/multidim/deployment.yaml b/charts/eoapi/templates/services/multidim/deployment.yaml
@@ -41,7 +41,8 @@ spec:
     spec:
       {{- include "eoapi.pgstacInitContainers" . | nindent 6 }}
       containers:
-      - image: {{ .Values.multidim.image.name }}:{{ .Values.multidim.image.tag }}
+      - image: {{ include "eoapi.containerImage" .Values.multidim.image }}
+        imagePullPolicy: {{ .Values.multidim.image.pullPolicy | default "IfNotPresent" }}
         name: multidim
         command:
           {{- toYaml .Values.multidim.command | nindent 10 }}

diff --git a/charts/eoapi/templates/services/raster/deployment.yaml b/charts/eoapi/templates/services/raster/deployment.yaml
@@ -41,7 +41,8 @@ spec:
     spec:
       {{- include "eoapi.pgstacInitContainers" . | nindent 6 }}
       containers:
-      - image: {{ .Values.raster.image.name }}:{{ .Values.raster.image.tag }}
+      - image: {{ include "eoapi.containerImage" .Values.raster.image }}
+        imagePullPolicy: {{ .Values.raster.image.pullPolicy | default "IfNotPresent" }}
         name: raster
         command:
           {{- toYaml .Values.raster.command | nindent 10 }}

diff --git a/charts/eoapi/templates/services/stac/deployment.yaml b/charts/eoapi/templates/services/stac/deployment.yaml
@@ -41,7 +41,8 @@ spec:
     spec:
       {{- include "eoapi.pgstacInitContainers" . | nindent 6 }}
       containers:
-      - image: {{ .Values.stac.image.name }}:{{ .Values.stac.image.tag }}
+      - image: {{ include "eoapi.containerImage" .Values.stac.image }}
+        imagePullPolicy: {{ .Values.stac.image.pullPolicy | default "IfNotPresent" }}
         name: stac
         command:
           {{- toYaml .Values.stac.command | nindent 10 }}

diff --git a/charts/eoapi/templates/services/vector/deployment.yaml b/charts/eoapi/templates/services/vector/deployment.yaml
@@ -41,7 +41,8 @@ spec:
     spec:
       {{- include "eoapi.pgstacInitContainers" . | nindent 6 }}
       containers:
-      - image: {{ .Values.vector.image.name }}:{{ .Values.vector.image.tag }}
+      - image: {{ include "eoapi.containerImage" .Values.vector.image }}
+        imagePullPolicy: {{ .Values.vector.image.pullPolicy | default "IfNotPresent" }}
         name: vector
         command:
           {{- toYaml .Values.vector.command | nindent 10 }}

diff --git a/charts/eoapi/templates/testing/deployment.yaml b/charts/eoapi/templates/testing/deployment.yaml
@@ -28,8 +28,8 @@ spec:
       {{- end }}
       containers:
       - name: mock-oidc
-        image: "{{ if .Values.testing.mockOidcServer.image }}{{ .Values.testing.mockOidcServer.image.repository | default "ghcr.io/alukach/mock-oidc-server" }}:{{ .Values.testing.mockOidcServer.image.tag | default "latest" }}{{ else }}ghcr.io/alukach/mock-oidc-server:latest{{ end }}"
-        imagePullPolicy: {{ if .Values.testing.mockOidcServer.image }}{{ .Values.testing.mockOidcServer.image.pullPolicy | default "IfNotPresent" }}{{ else }}IfNotPresent{{ end }}
+        image: {{ include "eoapi.containerImage" .Values.testing.mockOidcServer.image }}
+        imagePullPolicy: {{ .Values.testing.mockOidcServer.image.pullPolicy | default "IfNotPresent" }}
         env:
         - name: MOCK_OIDC_PORT
           value: "{{ .Values.testing.mockOidcServer.port | default 8888 }}"

diff --git a/charts/eoapi/tests/doc-server_test.yaml b/charts/eoapi/tests/doc-server_test.yaml
@@ -1,5 +1,6 @@
 suite: doc-server tests
 templates:
+  - templates/_helpers/core.tpl
   - templates/services/doc-server.yaml
 tests:
   - it: "renders landing page by default"

diff --git a/charts/eoapi/tests/image_tests.yaml b/charts/eoapi/tests/image_tests.yaml
@@ -0,0 +1,57 @@
+suite: container image configuration
+templates:
+  - templates/_helpers/core.tpl
+  - templates/_helpers/services.tpl
+  - templates/_helpers/database.tpl
+  - templates/services/stac/deployment.yaml
+  - templates/services/stac/configmap.yaml
+  - templates/services/doc-server.yaml
+  - templates/core/cloudevents-sink.yaml
+  - templates/core/knative-init.yaml
+  - templates/testing/deployment.yaml
+tests:
+  - it: stac deployment uses default image and pullPolicy
+    template: templates/services/stac/deployment.yaml
+    set:
+      stac.enabled: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: ghcr.io/stac-utils/stac-fastapi-pgstac:6.3.1
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: IfNotPresent
+
+  - it: stac deployment honors image override and Always pullPolicy
+    template: templates/services/stac/deployment.yaml
+    set:
+      stac:
+        enabled: true
+        image:
+          name: example.com/stac
+          tag: custom
+          pullPolicy: Always
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: example.com/stac:custom
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: Always
+
+  - it: doc-server uses pinned nginx image
+    template: templates/services/doc-server.yaml
+    set:
+      docServer:
+        enabled: true
+    documentIndex: 1
+    asserts:
+      - equal:
+          path: kind
+          value: Deployment
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: nginxinc/nginx-unprivileged:1.27.4-alpine
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: IfNotPresent