calico

Chart · Datastore · standard · v0.0.6

digest pinnedcosign signedSPDX SBOMSLSA provenanceamd64 · arm64

Hardened calico image, built from source on Wolfi.

Version

The latest line lives at the base page; older lines have their own page so you can pin and verify exactly that version. Only the most recent releases are listed — an older chart pins an older image digest.

Deployed image digest

sha256:311a3cef5c7d76ba22b6ec9aa396af730e0d49ae1d8530c82d143d6ce7e0c1b1

Chart OCI version

oci://ghcr.io/quenchworks/charts/calico:0.0.6

The chart pins its image by this signed digest, so you never track it yourself. Signatures, SBOM, and provenance attach to the same digest.

Signed

cosign keyless

SBOM

SPDX, on image

Provenance

SLSA build

Architectures

amd64, arm64

Runs as

nonroot (uid 1001)

Root filesystem

read-only

Install the chart

Deploy to Kubernetes with hardened defaults. The chart pins its image by signed digest, so you never track it yourself.

Install (latest)

helm install my-calico oci://ghcr.io/quenchworks/charts/calico --version 0.0.6

Deploys images (digest-pinned)

tigera-operator1.42.2
A
ghcr.io/quenchworks/images/tigera-operator@sha256:311a3cef5c7d76ba22b6ec9aa396af730e0d49ae1d8530c82d143d6ce7e0c1b1
calico-node3.32.0
A
ghcr.io/quenchworks/images/calico-node@sha256:89d45676d5c686d8375335bc72015eb3eb2ac3c7e89fea9778b0bf7b791a838e
calico-cni3.32.0
A
ghcr.io/quenchworks/images/calico-cni@sha256:04ded160dc1eed67d8471c38ec313642d03c36ba2282d4c6795875762919197b
calico-kube-controllers3.32.0
A
ghcr.io/quenchworks/images/calico-kube-controllers@sha256:1a5e47f6fa107a99e3ae7a46ebd54d332e88e02473514bf1c083e127a7ce0819
calico-typha3.32.0
A
ghcr.io/quenchworks/images/calico-typha@sha256:edad58a5e4a2475a9d8e8a776eee1c3dc7f5ca4c76e6470b5da2ee63925878f2
calico-key-cert-provisioner3.32.0
A
ghcr.io/quenchworks/images/calico-key-cert-provisioner@sha256:1a5a868fa49a261f60ca7fc8738c422bf5b24ed0a6923297a474ffe1ace52d68
calico-csi3.32.0
A
ghcr.io/quenchworks/images/calico-csi@sha256:e8e31e996ecd529398bd0fbc788f38a58fff111de6d1b221cb384bc79e25a8e6
calico-pod2daemon-flexvol3.32.0
A+
ghcr.io/quenchworks/images/calico-pod2daemon-flexvol@sha256:e43198a25b602b6bf91b6b797f27bafb1e4dddfaf706c07ad34ce60568451fa2
calico-node-driver-registrar3.32.0
A
ghcr.io/quenchworks/images/calico-node-driver-registrar@sha256:09b2a84211a9cff590b449d75001be1e7e0386ce28debc7d4adc9d3f6b221b57
kubectl1.37.1
A
ghcr.io/quenchworks/images/kubectl@sha256:924a275fd41f0e83a6cfdac29eea1587ebc88fc91d400e9c766bc9601b1f986c

Chart version: 0.0.6
App version: 3.32.0
Chart license: Apache-2.0
App license: Unknown
Signed: cosign (keyless)
Values schema: yes
Last published: 2026-10-22

Values keys

image: repository digest pullPolicy
nameOverride
operatorVersion
resources: requests limits
calicoImages: calico/node calico/cni calico/kube-controllers calico/typha calico/key-cert-provisioner calico/csi calico/pod2daemon-flexvol calico/node-driver-registrar
installation: enabled podCIDR encapsulation spec
wiring: image
imagePullSecrets
podAnnotations
podLabels
nodeSelector: kubernetes.io/os
affinity
tolerations
priorityClassName

Verify the chart

cosign verify ghcr.io/quenchworks/charts/calico:0.0.6 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Transparency

The chart publishes its attestations on GitHub and the image it deploys carries its own on the same digest, publicly verifiable with the commands above. Both log to the Sigstore transparency log (Rekor), which cosign verify checks for you.

View on ArtifactHub Chart source

Upstream project: https://quench-works.com