Eschewed features

• This issue is not requesting templating, unstuctured edits, build-time side-effects from args or env vars, or any other eschewed feature.

What would you like to have added?

A digest field in the helmCharts entry of kustomization.yaml that allows pinning an OCI Helm chart to a specific content digest, e.g.:

helmCharts:
- name: my-chart
  repo: oci://registry.example.com/charts
  version: 1.2.3
  digest: sha256:abc123...
  releaseName: my-release

Why is this needed?

OCI Helm charts are referenced by tag, which is mutable: a registry operator can push a different chart under the same tag at any time. In security-sensitive or reproducible-build environments, users need to pin charts to an immutable content address (digest) to guarantee that the exact same chart is used across every build, regardless of tag mutations.

Can you accomplish the motivating task without this feature, and if so, how?

Partially. The only workarounds are:

• Vendor the chart locally: pre-download it into chartHome and check it in.
  Kustomize skips the pull if the chart is already on disk.
  This works but adds binary/generated content to the repository.
• Embed the digest in the repo URL: e.g. setting repo: oci://registry.example.com/charts/my-chart@sha256:abc123.
  This does not work because kustomize appends name to the URL, breaking the reference and an empty name is not allowed.

What other solutions have you considered?

No other solution considered.

Anything else we should know?

No response

Feature ownership

• I am interested in contributing this feature myself! 🎉