fix: update v2 Dockerfile and Helm deployment.yaml for correct binary and args

[fseldow]

Description

This PR fixes the v2 Dockerfile and Helm chart deployment.yaml to match the actual v2 binary and CLI interface. These issues were discovered during hands-on AKS deployment testing of v2.0.0-alpha.1.

Changes

Dockerfile:

• Remove --platform=$BUILDPLATFORM — breaks non-buildx builds (e.g. az acr build, plain docker build)

charts/ratify/templates/deployment.yaml:

• Command: /app/ratify → /app/ratify-gatekeeper-provider (the actual binary name built by go build ./cmd/ratify-gatekeeper-provider)
• Args: v1 serve --http :6001 -c config.json → v2 Go flag style -address :6001 -config config.json -cert-file ... -key-file ...
• Remove v1-only args that don't exist in v2: --enable-crd-manager, --cache-*, --metrics-*, --health-port

Additional issues found during v2 deployment (not addressed in this PR)

1. No health endpoints: v2 alpha has no /healthz or /readyz — liveness/readiness probes cause kill loops
2. Helm pre-install hook: Uses image.crdRepository to pull CRD image that doesn't exist for v2 — must use --no-hooks and manually kubectl apply CRDs
3. StoreMux wildcard: *. pattern doesn't work as global catch-all — need explicit registry names or *.domain patterns
4. No Azure auth providers: v2 registry-store only supports static username/password; missing workload identity, managed identity, k8s secrets providers
5. cert-rotator vs Provider sync: cert-rotator regenerates certs on restart but doesn't update manually created ExternalDataProvider caBundle

Testing

Deployed and tested on AKS cluster (ratify-v2-test, eastus2) with Gatekeeper v3.22.0. End-to-end image verification flow works after these fixes.

Signed-off-by: Xinhe Li xinhl@microsoft.com

[Copilot]

Pull request overview

This PR aims to align the v2 container build and Helm deployment manifest with the actual v2 Gatekeeper provider binary name and its Go-flag-style CLI, and to remove a Docker build directive that can break non-buildx builds.

Changes:

• Remove --platform=$BUILDPLATFORM from the v2 Dockerfile builder stage.
• Update Helm Deployment command to run /app/ratify-gatekeeper-provider instead of /app/ratify.
• Replace v1-style serve --http ... -c ... args with v2 flags (-address, -config, -cert-file, -key-file, optional -gatekeeper-ca-cert-file), and remove several v1-only flags.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
Dockerfile	Removes build platform pinning from the builder stage.
charts/ratify/templates/deployment.yaml	Updates container command/args to match the v2 provider binary and CLI flags.

Comments suppressed due to low confidence (1)

charts/ratify/templates/deployment.yaml:81

• This PR removes the v1 --metrics-* args, but the chart still advertises Prometheus scraping via pod annotations and (optionally) exposes a metrics containerPort controlled by .Values.instrumentation.metricsEnabled/metricsPort. The v2 gatekeeper-provider codebase doesn’t implement a metrics endpoint (no metrics handlers), so enabling scraping will produce failing scrapes and a misleading configuration surface. Consider removing/guarding the metrics annotations/port for v2, or implementing a metrics endpoint if it’s still intended to be supported.

            {{- if (lookup "v1" "Secret" .Release.Namespace "gatekeeper-webhook-server-cert") }}
            - "-gatekeeper-ca-cert-file"
            - "/usr/local/tls/client-ca/ca.crt"
            {{- end }}
          ports:
            - containerPort: 6001
            {{- if .Values.instrumentation.metricsEnabled }}
            - containerPort: {{ required "You must provide .Values.instrumentation.metricsPort" .Values.instrumentation.metricsPort }}
            {{- end }}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.