Clarify distroless images in Helm values

Responds to hugoShaka feedback.

docs/pages/includes/helm-reference/zz_generated.teleport-kube-agent.mdx

@@ -1127,7 +1127,8 @@ For this reason, it is strongly discouraged to set a custom image when using
 automatic updates. Teleport Cloud uses automatic updates by default.
 </Admonition>
 
-Hardened distroless images are used by default.
+By default, the image contains only the Teleport application and its runtime
+dependencies, and does not contain a shell.
 This setting only takes effect when [`enterprise`](#enterprise) is `false`.
 When running an enterprise version, you must use
 [`enterpriseImage`](#enterpriseImage) instead.
@@ -1153,7 +1154,8 @@ Teleport-published image.
   using automatic updates. Teleport Cloud uses automatic updates by default.
 </Admonition>
 
-Hardened distroless images are used by default.
+By default, the image contains only the Teleport application and its runtime
+dependencies, and does not contain a shell.
 This setting only takes effect when [`enterprise`](#enterprise) is `true`.
 When running an enterprise version, you must use [`image`](#image) instead.
 

examples/chart/teleport-cluster/values.yaml

@@ -568,11 +568,13 @@ tls:
 # Values that you shouldn't need to change.
 ##################################################
 
-# Container image for the cluster.
-# Hardened distroless images are used by default.
+# Container image for the cluster. By default, the image contains only the
+# Teleport application and its runtime dependencies, and does not contain a
+# shell.
 image: public.ecr.aws/gravitational/teleport-distroless
-# Enterprise version of the image
-# Hardened distroless images are used by default.
+# Enterprise version of the image. By default, the image contains only the
+# Teleport application and its runtime dependencies, and does not contain a
+# shell.
 enterpriseImage: public.ecr.aws/gravitational/teleport-ent-distroless
 # Optional array of imagePullSecrets, to use when pulling from a private registry
 imagePullSecrets: []

examples/chart/teleport-kube-agent/values.yaml

@@ -891,7 +891,8 @@ adminClusterRoleBinding:
 # automatic updates. Teleport Cloud uses automatic updates by default.
 # </Admonition>
 #
-# Hardened distroless images are used by default.
+# By default, the image contains only the Teleport application and its runtime
+# dependencies, and does not contain a shell.
 # This setting only takes effect when [`enterprise`](#enterprise) is `false`.
 # When running an enterprise version, you must use
 # [`enterpriseImage`](#enterpriseImage) instead.
@@ -912,7 +913,8 @@ image: public.ecr.aws/gravitational/teleport-distroless
 #   using automatic updates. Teleport Cloud uses automatic updates by default.
 # </Admonition>
 #
-# Hardened distroless images are used by default.
+# By default, the image contains only the Teleport application and its runtime
+# dependencies, and does not contain a shell.
 # This setting only takes effect when [`enterprise`](#enterprise) is `true`.
 # When running an enterprise version, you must use [`image`](#image) instead.
 enterpriseImage: public.ecr.aws/gravitational/teleport-ent-distroless