gravitee-apim

Chart · Datastore · standard · v0.0.5

digest pinnedcosign signedSPDX SBOMSLSA provenanceamd64 · arm64

Hardened gravitee-apim image, built from source on Wolfi.

Version

The latest line lives at the base page; older lines have their own page so you can pin and verify exactly that version. Only the most recent releases are listed — an older chart pins an older image digest.

Deployed image digest

sha256:c1add7969841beade2ae38b0ee3b7a0e62af8ec962b7fbbc5f3f11094a102cba

Chart OCI version

oci://ghcr.io/quenchworks/charts/gravitee-apim:0.0.5

The chart pins its image by this signed digest, so you never track it yourself. Signatures, SBOM, and provenance attach to the same digest.

Signed

cosign keyless

SBOM

SPDX, on image

Provenance

SLSA build

Architectures

amd64, arm64

Runs as

nonroot (uid 1001)

Root filesystem

read-only

Install the chart

Deploy to Kubernetes with hardened defaults. The chart pins its image by signed digest, so you never track it yourself.

Install (latest)

helm install my-gravitee-apim oci://ghcr.io/quenchworks/charts/gravitee-apim --version 0.0.5

Deploys images (digest-pinned)

gravitee-gateway4.12.23
D
ghcr.io/quenchworks/images/gravitee-gateway@sha256:c1add7969841beade2ae38b0ee3b7a0e62af8ec962b7fbbc5f3f11094a102cba
gravitee-management-api4.12.23
D
ghcr.io/quenchworks/images/gravitee-management-api@sha256:94c7e79ad747c7ba027cf8270a9b10452e1b033b1664eb37d68a8c92b4eaa28d
gravitee-console4.12.23
A+
ghcr.io/quenchworks/images/gravitee-console@sha256:7a781baef42881acba4c84692d2bd3d6a956d0993c7e1e7bcf6f8a01e8fc0fe5
mongodb8.0.34
A+
ghcr.io/quenchworks/images/mongodb@sha256:9307ff34180e232344dd55411c18ae36b79986983386cbfa7c8c42c7d1bc9d65

Chart version: 0.0.5
App version: 4.12.23
Chart license: Apache-2.0
App license: Unknown
Signed: cosign (keyless)
Values schema: yes
Last published: 2026-10-22

Values keys

image: pullPolicy
nameOverride
fullnameOverride
gateway: image replicaCount javaOpts service resources extraEnv
api: image replicaCount javaOpts service resources extraEnv
console: enabled image replicaCount service resources
admin: password existingSecret existingSecretKey
nodeApi: password
jwtSecret
encryptionSecret
database
mongodb: enabled image auth primary
externalMongodb: uri existingSecret existingSecretUriKey
ingress: enabled className annotations consoleHost gatewayHost tls
serviceAccount: create name annotations automountServiceAccountToken
podAnnotations
podLabels
podSecurityContext
containerSecurityContext
nodeSelector
tolerations
affinity
imagePullSecrets

Verify the chart

cosign verify ghcr.io/quenchworks/charts/gravitee-apim:0.0.5 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Transparency

The chart publishes its attestations on GitHub and the image it deploys carries its own on the same digest, publicly verifiable with the commands above. Both log to the Sigstore transparency log (Rekor), which cosign verify checks for you.

View on ArtifactHub Chart source

Upstream project: https://quench-works.com