fix(shield): support digest pinning for allowlist waiter image (#2607)

Author: francesco-furlan

charts/shield/Chart.yaml

@@ -13,5 +13,5 @@ maintainers:
   - name: mavimo
     email: [email protected]
 type: application
-version: 1.37.0
+version: 1.37.1
 appVersion: "1.0.0"

charts/shield/templates/host/_helpers.tpl

@@ -341,6 +341,14 @@ true
 {{- default (include "host.allowlist_waiter.fullname" .) .Values.gke_autopilot.allowlist_waiter.service_account_name }}
 {{- end }}
 
+{{- define "host.allowlist_waiter.tag_separator" -}}
+  {{- if (hasPrefix "sha256:" .Values.gke_autopilot.allowlist_waiter.image.tag) -}}
+    @
+  {{- else -}}
+    :
+  {{- end -}}
+{{- end }}
+
 {{- define "host.allowlist_waiter.image" -}}
-{{- .Values.gke_autopilot.allowlist_waiter.image.registry -}} / {{- .Values.gke_autopilot.allowlist_waiter.image.repository -}} : {{- .Values.gke_autopilot.allowlist_waiter.image.tag }}
+{{- .Values.gke_autopilot.allowlist_waiter.image.registry -}} / {{- .Values.gke_autopilot.allowlist_waiter.image.repository -}} {{- include "host.allowlist_waiter.tag_separator" . -}} {{- .Values.gke_autopilot.allowlist_waiter.image.tag }}
 {{- end }}