Repository navigation
Get rid of bitnami images - #1374
Conversation
Signed-off-by: Andrei Kvapil <[email protected]>
WalkthroughContainer images for several Helm hook Jobs were switched to docker.io/alpine/k8s:1.33.4. New image configuration fields were added in multiple values.yaml files for dashboard (kubeapps), SeaweedFS, Velero, and Vertical Pod Autoscaler. No command/args or logic changes were introduced. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
Poem
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary of Changes
Hello Andrei Kvapil (@kvaps), I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request primarily focuses on standardizing and updating the container images used across several Kubernetes components. The main objective is to replace generic bitnami/kubectl images with a more lightweight and consistent docker.io/alpine/k8s:1.33.4 image for various operational hooks and utilities. Additionally, it introduces explicit image definitions for the Dashboard component, leveraging bitnamilegacy repositories for its core services.
Highlights
- Standardized kubectl Image: Replaced bitnami/kubectl with docker.io/alpine/k8s:1.33.4 across various components including virtual machine update hooks, PVC resize hooks, etcd hooks, and SeaweedFS hooks.
- New kubectl Image Definitions: Introduced explicit kubectl image configurations using docker.io/alpine/k8s:1.33.4 for Velero, Vertical Pod Autoscaler, and SeaweedFS volume resize hooks.
- Dashboard Image Updates: Explicitly defined images for the Dashboard's frontend (nginx), authentication proxy (oauth2-proxy), Redis, and Redis's kubectl helper using bitnamilegacy repositories.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | Gemini (@gemini-code-assist) | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request aims to replace Bitnami container images. Most changes replace bitnami/kubectl with alpine/k8s, which is a good move away from :latest tags towards pinned versions for better stability. However, I've found a critical issue: the chosen tag 1.33.4 for alpine/k8s appears to be invalid and will likely cause image pull failures across multiple components. I've suggested a valid tag in my comments. Additionally, one of the changes introduces bitnamilegacy images, which contradicts the PR's stated goal. I've left a comment seeking clarification on this point.
| containers: | ||
| - name: update-resources | ||
| image: bitnami/kubectl:latest | ||
| image: docker.io/alpine/k8s:1.33.4 |
There was a problem hiding this comment.
The image tag 1.33.4 for docker.io/alpine/k8s does not appear to be valid and will likely cause image pull errors. Please use a valid tag from Docker Hub. For example, 1.29.3 is a recent, valid tag.
image: docker.io/alpine/k8s:1.29.3| containers: | ||
| - name: resize | ||
| image: bitnami/kubectl | ||
| image: docker.io/alpine/k8s:1.33.4 |
There was a problem hiding this comment.
The image tag 1.33.4 for docker.io/alpine/k8s does not appear to be valid and will likely cause image pull errors. Please use a valid tag from Docker Hub. For example, 1.29.3 is a recent, valid tag.
image: docker.io/alpine/k8s:1.29.3| containers: | ||
| - name: update-resources | ||
| image: bitnami/kubectl:latest | ||
| image: docker.io/alpine/k8s:1.33.4 |
There was a problem hiding this comment.
The image tag 1.33.4 for docker.io/alpine/k8s does not appear to be valid and will likely cause image pull errors. Please use a valid tag from Docker Hub. For example, 1.29.3 is a recent, valid tag.
image: docker.io/alpine/k8s:1.29.3| containers: | ||
| - name: kubectl | ||
| image: bitnami/kubectl:latest | ||
| image: docker.io/alpine/k8s:1.33.4 |
There was a problem hiding this comment.
The image tag 1.33.4 for docker.io/alpine/k8s does not appear to be valid and will likely cause image pull errors. Please use a valid tag from Docker Hub. For example, 1.29.3 is a recent, valid tag.
image: docker.io/alpine/k8s:1.29.3| containers: | ||
| - name: kubectl | ||
| image: bitnami/kubectl:latest | ||
| image: docker.io/alpine/k8s:1.33.4 |
There was a problem hiding this comment.
The image tag 1.33.4 for docker.io/alpine/k8s does not appear to be valid and will likely cause image pull errors. Please use a valid tag from Docker Hub. For example, 1.29.3 is a recent, valid tag.
image: docker.io/alpine/k8s:1.29.3| volume: | ||
| replicas: 2 | ||
| resizeHook: | ||
| image: docker.io/alpine/k8s:1.33.4 |
There was a problem hiding this comment.
The image tag 1.33.4 for docker.io/alpine/k8s does not appear to be valid and will likely cause image pull errors. Please use a valid tag from Docker Hub. For example, 1.29.3 is a recent, valid tag.
image: docker.io/alpine/k8s:1.29.3| repository: docker.io/alpine/k8s | ||
| tag: 1.33.4 |
There was a problem hiding this comment.
The image tag 1.33.4 for docker.io/alpine/k8s does not appear to be valid and will likely cause image pull errors. Please use a valid tag from Docker Hub. For example, 1.29.3 is a recent, valid tag.
repository: docker.io/alpine/k8s
tag: 1.29.3| repository: alpine/k8s | ||
| tag: 1.33.4 |
There was a problem hiding this comment.
The image tag 1.33.4 for alpine/k8s does not appear to be valid and will likely cause image pull errors. Please use a valid tag from Docker Hub. For example, 1.29.3 is a recent, valid tag.
repository: alpine/k8s
tag: 1.29.3| frontend: | ||
| image: | ||
| repository: bitnamilegacy/nginx | ||
| authProxy: | ||
| image: | ||
| repository: bitnamilegacy/oauth2-proxy | ||
| redis: | ||
| image: | ||
| repository: bitnamilegacy/redis | ||
| kubectl: | ||
| image: | ||
| repository: bitnamilegacy/kubectl |
There was a problem hiding this comment.
The PR title states the goal is to 'Get rid of bitnami images', but these changes introduce bitnamilegacy/* images, which contradicts this goal. Furthermore, a bitnamilegacy/kubectl image is being introduced, while other parts of this PR are actively removing bitnami/kubectl in favor of alpine/k8s.
Could you please clarify the reasoning behind using bitnamilegacy images? If their use is intentional and necessary, please update the pull request title and description to accurately reflect all changes. For example, a title like 'feat: Update container images and replace kubectl' would be more descriptive.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (9)
packages/apps/vm-instance/templates/vm-update-hook.yaml (1)
44-44: Parametrize the kubectl image and avoid hardcoding docker.ioMake the image configurable (with sane defaults) to support air-gapped installs, private mirrors, and cluster-version alignment. Also consider digest pinning for reproducibility.
Apply:
- image: docker.io/alpine/k8s:1.33.4 + image: '{{ default "docker.io/alpine/k8s" .Values.hooks.kubectl.image.repository }}:{{ default "1.33.4" .Values.hooks.kubectl.image.tag }}' + imagePullPolicy: {{ default "IfNotPresent" .Values.hooks.kubectl.image.pullPolicy | quote }}packages/apps/virtual-machine/templates/vm-update-hook.yaml (1)
54-54: Same here: make kubectl image configurable and consider digest pinningMirror the values-driven pattern (e.g., .Values.hooks.kubectl.image.*) rather than hardcoding. This keeps VM and VM-instance hooks consistent and easier to backport.
- image: docker.io/alpine/k8s:1.33.4 + image: '{{ default "docker.io/alpine/k8s" .Values.hooks.kubectl.image.repository }}:{{ default "1.33.4" .Values.hooks.kubectl.image.tag }}'packages/system/seaweedfs/templates/hook.yaml (1)
29-29: Standardize via values and enable registry overridesAs elsewhere, avoid hardcoding the kubectl image; wire it to chart values (with defaults) so operators can point to private registries.
- image: docker.io/alpine/k8s:1.33.4 + image: '{{ default "docker.io/alpine/k8s" .Values.hook.kubectl.image.repository }}:{{ default "1.33.4" .Values.hook.kubectl.image.tag }}'packages/apps/vm-disk/templates/pvc-resize-hook.yaml (2)
22-22: Parametrize image; keep hook images consistent across chartsUse a shared values path (e.g., .Values.hooks.kubectl.image.*) for all hook jobs to reduce drift and simplify ops.
- image: docker.io/alpine/k8s:1.33.4 + image: '{{ default "docker.io/alpine/k8s" .Values.hooks.kubectl.image.repository }}:{{ default "1.33.4" .Values.hooks.kubectl.image.tag }}'
22-22: Double-check sh flags with busybox/ashYou use "sh -xec" here vs. "-exc" elsewhere. Both are fine, but unify for consistency to avoid surprises in differing shells.
- command: ["sh", "-xec"] + command: ["sh", "-exc"]packages/system/velero/values.yaml (1)
16-19: Add optional digest and pullPolicy fieldsEnable immutable deployments and reproducible restores.
kubectl: image: repository: docker.io/alpine/k8s tag: 1.33.4 + digest: "" # e.g., sha256:... + pullPolicy: IfNotPresentpackages/system/seaweedfs/values.yaml (1)
24-25: Standardize image schema and pin by digest for supply-chain safety
volume.resizeHook.imageis consumed bytemplates/volume/volume-resize-hook.yaml(line 71), so splitting it into structured fields requires updating that template. For consistency with other charts and to avoid tag drift, adopt the image-object pattern and pin a digest:- volume: - resizeHook: - image: docker.io/alpine/k8s:1.33.4 + volume: + resizeHook: + image: + registry: docker.io + repository: alpine/k8s + tag: 1.33.4 + digest: sha256:<pin-me>Then in
templates/volume/volume-resize-hook.yaml:- image: {{ .Values.volume.resizeHook.image }} + image: "{{ .Values.volume.resizeHook.registry }}/{{ .Values.volume.resizeHook.repository }}:{{ .Values.volume.resizeHook.tag }}@{{ .Values.volume.resizeHook.digest }}"packages/extra/etcd/templates/hook/job.yaml (1)
28-28: Pin alpine/k8s:1.33.4 to a digest and verify kubectl version
- Multi-arch digests exist for amd64 (sha256:dc13a534f6dcb65bb84650d830e7ad04c3caa4a97429c85b4a541b3e1556e8c0) and arm64 (sha256:3e1ebd6f8278cd67caaf51c73af5f756357cef558fbc29f00405429ff58e7432). Replace
image: docker.io/alpine/k8s:1.33.4
with
image: docker.io/alpine/k8s@<digest>
to pin by digest.- Confirm the kubectl binary in this image aligns with your cluster’s minor version.
Optional refactor (recommended for reliability and security):
- name: kubectl image: docker.io/alpine/k8s@<digest> imagePullPolicy: IfNotPresent securityContext: runAsNonRoot: true readOnlyRootFilesystem: truepackages/system/dashboard/values.yaml (1)
24-35: Clarify bitnamilegacy usage and pin image tags
- The bitnamilegacy Docker Hub repos exist with digest tags (e.g.,
bitnamilegacy/nginx@sha256-b2e803958eda5723aae1e36ed0e418f6e0c79e7ce890820eba9cad85a6381286).- Confirm whether
bitnamilegacy/*images are intended as long-term replacements for Bitnami or if official/community-supported images should be used instead.- Add
registryplus explicittagordigestfields for each image to prevent drift.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (9)
packages/apps/virtual-machine/templates/vm-update-hook.yaml(1 hunks)packages/apps/vm-disk/templates/pvc-resize-hook.yaml(1 hunks)packages/apps/vm-instance/templates/vm-update-hook.yaml(1 hunks)packages/extra/etcd/templates/hook/job.yaml(1 hunks)packages/system/dashboard/values.yaml(1 hunks)packages/system/seaweedfs/templates/hook.yaml(1 hunks)packages/system/seaweedfs/values.yaml(1 hunks)packages/system/velero/values.yaml(1 hunks)packages/system/vertical-pod-autoscaler/values.yaml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Build
🔇 Additional comments (3)
packages/apps/vm-instance/templates/vm-update-hook.yaml (1)
44-44: Image tag verified:docker.io/alpine/k8s:1.33.4exists with both amd64 and arm64 manifests—no further action needed.packages/apps/virtual-machine/templates/vm-update-hook.yaml (1)
54-54: Kubectl/cluster version skewHardcoding a kubectl minor can violate the supported skew with older clusters. Keep this user-overridable and document expected minor range in values.yaml.
Would you like me to add a short note to values.yaml explaining the recommended kubectl minor relative to cluster .Capabilities.KubeVersion?
packages/system/seaweedfs/templates/hook.yaml (1)
29-29: Docker image tag1.33.4verified present on Docker Hub No further changes required.
| kubectl: | ||
| image: | ||
| repository: docker.io/alpine/k8s | ||
| tag: 1.33.4 |
There was a problem hiding this comment.
💡 Verification agent
❓ Verification inconclusive
Good move: expose kubectl image via values
Nice addition. Ensure templates actually consume velero.kubectl.image.{repository,tag}; otherwise this is a no-op.
🏁 Script executed:
#!/bin/bash
# Verify the new values are referenced by the Velero templates
rg -nC2 -iP '\bvelero\.kubectl\.image\.(repository|tag)\b'Length of output: 60
Ensure Helm templates consume the new kubectl image values
No occurrences of .Values.velero.kubectl.image.repository or .Values.velero.kubectl.image.tag were found in the Velero chart templates—please update your Helm templates under packages/system/velero/templates to reference these values.
| image: | ||
| registry: docker.io | ||
| repository: alpine/k8s | ||
| tag: 1.33.4 |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Image block is nested under crds due to indentation—likely not read by templates
As written, image sits under vertical-pod-autoscaler.crds.image, not as a sibling to updater/recommender. Move it out one level.
vertical-pod-autoscaler:
crds:
enabled: false
-
- image:
- registry: docker.io
- repository: alpine/k8s
- tag: 1.33.4
+ image:
+ registry: docker.io
+ repository: alpine/k8s
+ tag: 1.33.4Confirm the value path expected by templates (adjust grep if a different key is used, e.g., kubectl.image):
🏁 Script executed:
#!/bin/bash
rg -n -C2 -g 'packages/**' 'vertical-pod-autoscaler(\.|\[).*image'Length of output: 68
🏁 Script executed:
#!/bin/bash
set -eux
chart_dir="packages/system/vertical-pod-autoscaler"
echo "Chart root directory:"
ls -1 "$chart_dir"
echo
echo "Templates directory:"
ls -1 "$chart_dir/templates"
echo
echo "Searching for .Values references in templates:"
rg -n '\.Values\.' "$chart_dir/templates"
echo
echo "Searching for image references in templates:"
rg -n 'image:' "$chart_dir/templates"
echo
echo "Searching specifically for crds.image references:"
rg -n '\.Values\..*crds.*image' "$chart_dir/templates" || echo "No crds.image references found"
echo
echo "Searching for any .Values.*image references:"
rg -n '\.Values\..*image' "$chart_dir/templates"Length of output: 1021
🏁 Script executed:
#!/bin/bash
sed -n '1,200p' packages/system/vertical-pod-autoscaler/templates/vpa-for-vpa.yamlLength of output: 2052
🏁 Script executed:
#!/bin/bash
sed -n '1,200p' packages/system/vertical-pod-autoscaler/values.yamlLength of output: 987
🏁 Script executed:
#!/bin/bash
set -eux
chart_charts_dir="packages/system/vertical-pod-autoscaler/charts"
echo "Contents of charts directory:"
ls -1 "$chart_charts_dir" || echo "(empty or not a directory)"
echo
for sub in "$chart_charts_dir"/*; do
[ -d "$sub" ] || continue
echo "=== Subchart: $(basename "$sub") ==="
if [ -f "$sub/values.yaml" ]; then
echo "Top of $sub/values.yaml:"
sed -n '1,50p' "$sub/values.yaml"
else
echo "No values.yaml found in $sub"
fi
echo
doneLength of output: 2421
🏁 Script executed:
#!/bin/bash
# Print first 200 lines of the subchart values to locate image defaults
sed -n '1,200p' packages/system/vertical-pod-autoscaler/charts/vertical-pod-autoscaler/values.yaml
echo
echo "Searching for .Values.image references in subchart templates:"
rg -n '\.Values\..*image' packages/system/vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templatesLength of output: 11110
Include the crds.image block in the HelmRelease values
The root template templates/vpa-for-vpa.yaml never propagates your values.yaml’s crds.image override into the generated HelmRelease spec. Under the existing values.vertical-pod-autoscaler section, add:
values:
vertical-pod-autoscaler:
nameOverride: vpa-for-vpa
fullnameOverride: vpa-for-vpa
admissionController:
enabled: false
recommender:
extraArgs: …
resources: …
+ crds:
+ enabled: {{ .Values.vertical-pod-autoscaler.crds.enabled }}
+ image:
+ registry: {{ .Values.vertical-pod-autoscaler.crds.image.registry }}
+ repository: {{ .Values.vertical-pod-autoscaler.crds.image.repository }}
+ tag: {{ .Values.vertical-pod-autoscaler.crds.image.tag }}This ensures the CRD-creation Job uses the custom image specified in values.yaml.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| image: | |
| registry: docker.io | |
| repository: alpine/k8s | |
| tag: 1.33.4 | |
| values: | |
| vertical-pod-autoscaler: | |
| nameOverride: vpa-for-vpa | |
| fullnameOverride: vpa-for-vpa | |
| admissionController: | |
| enabled: false | |
| recommender: | |
| extraArgs: … | |
| resources: … | |
| crds: | |
| enabled: {{ .Values.vertical-pod-autoscaler.crds.enabled }} | |
| image: | |
| registry: {{ .Values.vertical-pod-autoscaler.crds.image.registry }} | |
| repository: {{ .Values.vertical-pod-autoscaler.crds.image.repository }} | |
| tag: {{ .Values.vertical-pod-autoscaler.crds.image.tag }} | |
| image: | |
| registry: docker.io | |
| repository: alpine/k8s | |
| tag: 1.33.4 |
🤖 Prompt for AI Agents
In packages/system/vertical-pod-autoscaler/values.yaml around lines 7 to 10, the
values lack a crds.image section under the values.vertical-pod-autoscaler key so
the HelmRelease template cannot pick up a custom CRD Job image; add a nested
crds: image: block under values.vertical-pod-autoscaler with registry,
repository and tag fields (matching the existing image fields or your override)
so the template can propagate values.vertical-pod-autoscaler.crds.image into the
generated HelmRelease spec.
1 participant
Signed-off-by: Andrei Kvapil [email protected]
What this PR does
This PR removes bitnami images from all charts. Bitnami has deprecated their free images, see details here:
Also dashboard has moved helper images to
bitnamilegacy, we will fully replace it by our new dashboard soon:Release note
Summary by CodeRabbit
New Features
Chores