From fefbae8082822463fb5f35c6591e40b3a8066aff Mon Sep 17 00:00:00 2001
From: Sourav Karjee <sourav.karjee@bitgo.com>
Date: Fri, 21 Aug 2026 08:01:20 +0000
Subject: [PATCH] feat: replace ghcr.io/slok/sloth with signed ECR mirror

Replace unsigned ghcr.io/slok/sloth:v0.11.0 with the signed,
mirrored ECR image across all deployment manifests:

- deploy/kubernetes/raw/sloth.yaml
- deploy/kubernetes/raw/sloth-with-common-plugins.yaml
- deploy/kubernetes/helm/sloth/values.yaml (repository + tag)
- deploy/kubernetes/helm/sloth/tests/testdata/output/deployment_default.yaml

The ECR image uses tag+digest pinning
(v0.11.0@sha256:b45240f...) so the no template changes
are required beyond updating the image reference.

BitGo policy requires all deployed images to be signed.
The upstream ghcr.io/slok/sloth image is unsigned; this
replaces it with the mirrored, signed version in BitGo ECR,
satisfying the image signature coverage tracked in INF-2852.

Ticket: INF-2854
Session-Id: 7ef4cbda-f843-46b1-8040-9c55880e899b
Task-Id: 4389ea07-1e7a-469b-b150-2e3cbfa1c3b6
---
 .../helm/sloth/tests/testdata/output/deployment_default.yaml  | 2 +-
 deploy/kubernetes/helm/sloth/values.yaml                      | 4 ++--
 deploy/kubernetes/raw/sloth-with-common-plugins.yaml          | 2 +-
 deploy/kubernetes/raw/sloth.yaml                              | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/deploy/kubernetes/helm/sloth/tests/testdata/output/deployment_default.yaml b/deploy/kubernetes/helm/sloth/tests/testdata/output/deployment_default.yaml
index 2d19c3a5..8837fed0 100644
--- a/deploy/kubernetes/helm/sloth/tests/testdata/output/deployment_default.yaml
+++ b/deploy/kubernetes/helm/sloth/tests/testdata/output/deployment_default.yaml
@@ -32,7 +32,7 @@ spec:
       serviceAccountName: sloth
       containers:
         - name: sloth
-          image: ghcr.io/slok/sloth:v0.11.0
+          image: 199765120567.dkr.ecr.us-west-2.amazonaws.com/ghcr.io/slok/sloth:v0.11.0@sha256:b45240f284201e1ef647d9a7b466a0ebb6057f53be555d17318ef2495b54bd16
           args:
             - kubernetes-controller
             - --sli-plugins-path=/plugins
diff --git a/deploy/kubernetes/helm/sloth/values.yaml b/deploy/kubernetes/helm/sloth/values.yaml
index 8c8b309d..9cdee28b 100644
--- a/deploy/kubernetes/helm/sloth/values.yaml
+++ b/deploy/kubernetes/helm/sloth/values.yaml
@@ -1,8 +1,8 @@
 labels: {}
 
 image:
-  repository: ghcr.io/slok/sloth
-  tag: v0.11.0
+  repository: 199765120567.dkr.ecr.us-west-2.amazonaws.com/ghcr.io/slok/sloth
+  tag: v0.11.0@sha256:b45240f284201e1ef647d9a7b466a0ebb6057f53be555d17318ef2495b54bd16
 
 # -- Container resources: requests and limits for CPU, Memory
 resources:
diff --git a/deploy/kubernetes/raw/sloth-with-common-plugins.yaml b/deploy/kubernetes/raw/sloth-with-common-plugins.yaml
index 21de1723..1e1cf1fc 100644
--- a/deploy/kubernetes/raw/sloth-with-common-plugins.yaml
+++ b/deploy/kubernetes/raw/sloth-with-common-plugins.yaml
@@ -85,7 +85,7 @@ spec:
       serviceAccountName: sloth
       containers:
         - name: sloth
-          image: ghcr.io/slok/sloth:v0.11.0
+          image: 199765120567.dkr.ecr.us-west-2.amazonaws.com/ghcr.io/slok/sloth:v0.11.0@sha256:b45240f284201e1ef647d9a7b466a0ebb6057f53be555d17318ef2495b54bd16
           args:
             - kubernetes-controller
             - --sli-plugins-path=/plugins
diff --git a/deploy/kubernetes/raw/sloth.yaml b/deploy/kubernetes/raw/sloth.yaml
index 458928f3..d34e79e9 100644
--- a/deploy/kubernetes/raw/sloth.yaml
+++ b/deploy/kubernetes/raw/sloth.yaml
@@ -85,7 +85,7 @@ spec:
       serviceAccountName: sloth
       containers:
         - name: sloth
-          image: ghcr.io/slok/sloth:v0.11.0
+          image: 199765120567.dkr.ecr.us-west-2.amazonaws.com/ghcr.io/slok/sloth:v0.11.0@sha256:b45240f284201e1ef647d9a7b466a0ebb6057f53be555d17318ef2495b54bd16
           args:
             - kubernetes-controller
           ports: