From 7b9e5adfff267c8d3944d787a14a9c3bb17377f9 Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sun, 4 Oct 2026 20:26:07 -0700
Subject: [PATCH] fix(k8s): pin cloudflared-tunnel to v0.27

Floating :latest with Always pulled whatever CI last pushed on any
pod restart. v0.27 is the digest already running (3f08847e).

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 k8s/cloudflared-tunnel-deployment.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/k8s/cloudflared-tunnel-deployment.yaml b/k8s/cloudflared-tunnel-deployment.yaml
index 3b4e22a..b1c3773 100644
--- a/k8s/cloudflared-tunnel-deployment.yaml
+++ b/k8s/cloudflared-tunnel-deployment.yaml
@@ -28,8 +28,8 @@ spec:
       - name: harbor-registry-secret
       containers:
       - name: cloudflared
-        image: harbor.dataknife.net/library/cloudflared-tunnel:latest
-        imagePullPolicy: Always
+        image: harbor.dataknife.net/library/cloudflared-tunnel:v0.27
+        imagePullPolicy: IfNotPresent
         env:
         - name: TUNNEL_TOKEN
           valueFrom: