Sync chart from pieced-operator 0.1.40

deploy/helm/pieced-operator/templates/crds/pieced.ch_piecedtenants.yaml

@@ -87,6 +87,18 @@ spec:
                 suspend:
                   type: boolean
                   description: Stops reconciliation without deleting resources.
+                openClawImage:
+                  type: object
+                  description: >
+                    Per-tenant override for the OpenClaw container image
+                    tag. When unset, the operator uses the platform
+                    default from the pieced-openclaw-config ConfigMap.
+                    Set by platform admins via the portal; customer-
+                    facing onboarding does not expose this field.
+                  properties:
+                    tag:
+                      type: string
+                      description: Image tag (e.g. "2026.4.22").
             status:
               type: object
               properties:

deploy/helm/pieced-operator/templates/openclaw-config-cm.yaml

@@ -0,0 +1,25 @@
+{{/*
+Platform-wide default OpenClaw image tag. Used by the operator when a
+PiecedTenant has no explicit `spec.openClawImage.tag` override.
+
+Tag-only by design — see internal/openclawconfig/loader.go for
+rationale (single image-selector field avoids SSA field-ownership
+ambiguity). For reproducibility-critical deployments, pin by using
+an immutable release tag.
+
+If `defaultTag` is empty (or this ConfigMap doesn't exist), the
+operator falls back to a hardcoded built-in version.
+
+Tenants without an `openClawImage` override automatically follow
+changes to this ConfigMap on the next reconcile — the operator
+watches it and re-enqueues affected tenants.
+*/}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pieced-openclaw-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: pieced-operator
+data:
+  defaultTag: {{ .Values.openClaw.defaultTag | quote }}