feat: move remaining bundled images off bitnamilegacy (postgresql, redis, kubectl sidecar)

Đang mở
  • Có gì không ổn?
#4,861 2 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
48/100
Loại issue
Tính năng
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
docker, kubernetes, typescript
Lĩnh vực
databases, infrastructure

Hướng nghiên cứu

Start with the chart's values.yaml and the PostgreSQL, Redis, and MinIO subchart dependencies; compare the ClickHouse migration in #4249 for the established approach. The issue prioritizes the token-syncer image as a standalone first step, then Redis and PostgreSQL migrations. Done means the bundled images no longer use bitnamilegacy and the affected services work with the replacement images, including data migration where needed.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

Is your feature request related to a problem? Please describe.

Chart 4.5.15 still pulls four images from the bitnamilegacy/* namespace. Broadcom froze that namespace when Bitnami moved to a paid catalogue — those tags no longer receive security patches, so the Debian base layers accumulate CVEs indefinitely with no upgrade path.

From values.yaml in chart 4.5.15:

Values path Image
postgres.image.repository bitnamilegacy/postgresql:17.5.0-debian-12-r12
redis.image.repository bitnamilegacy/redis:8.0.2-debian-12-r4
s3.image.repository bitnamilegacy/minio:2025.6.13-debian-12-r0
s3.console.image.repository bitnamilegacy/minio-object-browser:2.0.2-debian-12-r0
webapp.tokenSyncer.image.repository bitnamilegacy/kubectl:1.28

The first four come from Bitnami subchart dependencies (postgresql 16.7.14, redis 21.2.6, minio 17.0.9 via the s3 alias). The fifth is a first-party chart value.

bitnamilegacy/kubectl:1.28 is worth calling out separately. kubectl supports roughly ±1 minor version of skew against the API server. Pinned at 1.28, the token-syncer sidecar is already outside that window on any cluster running 1.30+, and increasingly so over time. It is also the only one of the five that is not tied to a subchart, so it is a one-line values change.

This affects every self-hosted deployment that uses the bundled datastores, which is the chart's default (postgres.deploy, redis.deploy and s3.deploy are all true).

Describe the solution you'd like to see

The same treatment ClickHouse received in 4.5.15 — first-party templates using the upstream official image, with digest support for reproducible pinning:

clickhouse:
  image:
    registry: docker.io
    repository: clickhouse/clickhouse-server
    tag: "26.2"
    digest: ""

That change was handled well: persistence.existingClaim auto-detects the PVC the Bitnami subchart left behind, a data-paths.xml ConfigMap points the server at the directory the old layout used, and a chown init container relabels the volume for the new uid — including on storage classes where fsGroup cannot relabel. Migrating from the bundled Bitnami ClickHouse was genuinely seamless as a result.

Applying the same pattern to postgres and redis would remove the remaining exposure. Upstream official images exist for both (postgres, redis, or valkey), and for the sidecar registry.k8s.io/kubectl is the upstream-maintained option.

Order of value, in our view:

  1. webapp.tokenSyncer.image — no subchart, no state, no migration. A values change.
  2. redis — stateful but largely reconstructible.
  3. postgresql — highest value and highest care required, since it holds the secret store and run state.

Describe alternate solutions

Override the subchart images in values. Not viable in practice: the Bitnami charts assume Bitnami's filesystem layout, entrypoints and uid conventions, so substituting an official image breaks the probes and init scripts. We looked at this and discounted it.

Point the chart at external services (deploy: false). This works and is what we have done for object storage — s3.deploy: false with s3.external.* removed both MinIO images cleanly. But it is not a general answer: it pushes every self-hoster toward managed Postgres and Redis, which defeats much of the point of a self-hosted chart, and the bundled path stays unpatched for everyone who does not.

Stay on bitnamilegacy and accept the risk. Defensible only while these services are cluster-internal with no ingress, which is the common case. It still shows up in image scanning and in security questionnaires, and it degrades over time as CVEs accumulate against frozen base layers.

Additional information

Related prior work:

  • #4249 — deploy ClickHouse from the official image instead of Bitnami (the precedent this asks to extend)
  • #4197 — ClickHouse writers require CH ≥25.8 while the chart bundled ClickHouse 25

Verified against chart 4.5.15 (oci://ghcr.io/triggerdotdev/charts/trigger) and against a running self-hosted deployment on k3s, where kubectl get pods -o jsonpath over the namespace confirms the five images above are what actually run.

Happy to test a pre-release chart against a live single-node self-hosted install if that is useful — we have just completed the 4.4.6 → 4.5.15 upgrade including the ClickHouse volume adoption, so the migration path is fresh.

Ngôn ngữ chính
TypeScript
Star
16.5k
Fork
1.5k
Merge trung bình
1 ngày 15 giờ
Pull request đã merge (30 ngày)
17

Chuẩn bị môi trường

Dự án này không cung cấp dev container, Dockerfile hay hướng dẫn đóng góp, nên bạn cần tự thiết lập môi trường: hãy bắt đầu từ README và xem hướng dẫn đóng góp lần đầu của chúng tôi để biết các bước chung.

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của triggerdotdev/trigger.dev

Tất cả issue của triggerdotdev/trigger.dev

Issue tương tự

Thêm issue về TypeScript

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.