[mongodb] Remove user-configurable images from MongoDB chart by kvaps · Pull Request #1901 · cozystack/cozystack

Andrei Kvapil (kvaps) · 2026-01-22T16:54:07Z

What this PR does

Removes the ability for users to specify custom container images (images.pmm and images.backup) in the MongoDB application values.

This is a security hardening measure - allowing users to specify arbitrary container images could lead to:

Running malicious or compromised images
Supply chain attacks through untrusted image registries
Privilege escalation if malicious images are designed to exploit the cluster

The images are now hardcoded in the template:

percona/pmm-client:2.44.1
percona/percona-backup-mongodb:2.11.0

Release note

[apps] Remove user-configurable images from MongoDB chart for security hardening

Summary by CodeRabbit

Refactor
- Removed container image customization options for MongoDB's monitoring and backup components. The system now uses fixed, pre-determined image versions (PMM Client 2.44.1 and Percona Backup MongoDB 2.11.0) to ensure deployment consistency and reduce configuration complexity.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

gemini-code-assist · 2026-01-22T16:54:20Z

Summary of Changes

Hello Andrei Kvapil (@kvaps), I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the security posture of the MongoDB application chart by eliminating user-configurable container images for its PMM and backup functionalities. By hardcoding these images, the change mitigates risks associated with malicious or compromised images, supply chain attacks, and potential privilege escalation, ensuring a more secure deployment environment.

Highlights

Security Hardening: Removed user-configurable container images for PMM and backup components in the MongoDB chart to prevent potential security vulnerabilities such as running malicious images or supply chain attacks.
Image Hardcoding: The pmm image is now hardcoded to percona/pmm-client:2.44.1, and the backup image is hardcoded to percona/percona-backup-mongodb:2.11.0 directly within the chart template.
Configuration Simplification: The images section, which previously allowed custom image specification, has been removed from values.yaml.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	Gemini (@gemini-code-assist)	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

coderabbitai · 2026-01-22T16:54:37Z

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

📝 Walkthrough

Walkthrough

This change removes customizable image configuration from the MongoDB Helm chart by eliminating the images field from values, schema, and documentation, while replacing templated image references with hardcoded image tags (percona/pmm-client:2.44.1 and percona/percona-backup-mongodb:2.11.0) in deployment templates.

Changes

Cohort / File(s)	Summary
Documentation and Schema `packages/apps/mongodb/README.md`, `packages/apps/mongodb/values.schema.json`	Removed Image configuration section and images field from external schema, eliminating documentation and validation for customizable image references
Helm Values Configuration `packages/apps/mongodb/values.yaml`	Removed Image configuration block with pmm and backup fields containing default image strings
Deployment Templates `packages/apps/mongodb/templates/mongodb.yaml`	Changed pmm and backup image references from templated values to hardcoded image tags
System Definition `packages/system/mongodb-rd/cozyrds/mongodb.yaml`	Removed "images" from keysOrder array, eliminating images-related keys from public ordering

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A rabbit's ode to locked-down images...

No more templates dancing in the night,
Images pinned down, locked up tight!
PMM and Backup get their fixed address,
Hardcoded versions, nothing less! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title '[mongodb] Remove user-configurable images from MongoDB chart' directly and clearly summarizes the main change: removing configurable images from the MongoDB Helm chart.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

This pull request enhances security by removing the ability for users to specify custom container images for PMM and backup agents in the MongoDB chart, hardcoding them instead. The changes are correct and effectively achieve this goal. I've added a couple of suggestions to improve the maintainability of these new hardcoded image versions by centralizing their definitions.

gemini-code-assist · 2026-01-22T16:55:10Z

  pmm:
    enabled: false
-    image: {{ .Values.images.pmm }}
+    image: percona/pmm-client:2.44.1


While hardcoding the image is the correct approach for security hardening, for better long-term maintainability, consider defining this image string in a more centralized location. For instance, you could define it as a variable at the top of this template file or in a helper template. This would group all static image definitions, making them easier to find and update in future releases.

gemini-code-assist · 2026-01-22T16:55:10Z

  backup:
    enabled: {{ .Values.backup.enabled | default false }}
-    image: {{ .Values.images.backup }}
+    image: percona/percona-backup-mongodb:2.11.0


Similar to the PMM image, centralizing this hardcoded backup image definition would improve maintainability. By defining all static images in one place (e.g., as variables at the top of the template or in a helper file), you make it easier for future maintainers to manage and update image versions consistently across the chart.

Remove the ability for users to specify custom container images (images.pmm and images.backup) in the MongoDB application values. This is a security hardening measure - allowing users to specify arbitrary container images could lead to running malicious or compromised images, supply chain attacks, or privilege escalation. The images are now hardcoded in the template: - percona/pmm-client:2.44.1 - percona/percona-backup-mongodb:2.11.0 Co-Authored-By: Claude <[email protected]> Signed-off-by: Andrei Kvapil <[email protected]>

github-actions · 2026-01-22T22:15:31Z

Successfully created backport PR for release-0.41:

[Backport release-0.41] [mongodb] Remove user-configurable images from MongoDB chart #1904

…m MongoDB chart (#1904) # Description Backport of #1901 to `release-0.41`.

Andrei Kvapil (kvaps) requested a review from Timofei Larkin (lllamnyp) as a code owner January 22, 2026 16:54

Andrei Kvapil (kvaps) added the kind/backport Categorizes issue or PR as requiring a backport to the current release line label Jan 22, 2026

Andrei Kvapil (kvaps) requested a review from Nikita (nbykov0) as a code owner January 22, 2026 16:54

Andrei Kvapil (kvaps) added the kind/backport Categorizes issue or PR as requiring a backport to the current release line label Jan 22, 2026

Andrei Kvapil (kvaps) changed the title ~~[apps] Remove user-configurable images from MongoDB chart~~ [mongodb] Remove user-configurable images from MongoDB chart Jan 22, 2026

dosubot Bot added the size/S This PR changes 10-29 lines, ignoring generated files label Jan 22, 2026

Andrei Kvapil (kvaps) force-pushed the fix/mongodb-remove-user-images branch from adba964 to 862a9bf Compare January 22, 2026 16:55

dosubot Bot added size/M This PR changes 30-99 lines, ignoring generated files and removed size/S This PR changes 10-29 lines, ignoring generated files labels Jan 22, 2026

gemini-code-assist Bot reviewed Jan 22, 2026

View reviewed changes

Andrei Kvapil (kvaps) force-pushed the fix/mongodb-remove-user-images branch from 862a9bf to beb6e1a Compare January 22, 2026 16:55

Andrei Kvapil (kvaps) merged commit f8fea53 into main Jan 22, 2026
6 checks passed

Andrei Kvapil (kvaps) deleted the fix/mongodb-remove-user-images branch January 22, 2026 22:15

github-actions Bot mentioned this pull request Jan 22, 2026

[Backport release-0.41] [mongodb] Remove user-configurable images from MongoDB chart #1904

Merged

Andrei Kvapil (kvaps) added a commit that referenced this pull request Jan 22, 2026

[Backport release-0.41] [mongodb] Remove user-configurable images fro…

e38b7a0

…m MongoDB chart (#1904) # Description Backport of #1901 to `release-0.41`.

Navigation Menu

Repository navigation

[mongodb] Remove user-configurable images from MongoDB chart - #1901

[mongodb] Remove user-configurable images from MongoDB chart#1901
Andrei Kvapil (kvaps) merged 1 commit into
mainfrom
fix/mongodb-remove-user-images

Andrei Kvapil (kvaps) commented Jan 22, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

gemini-code-assist Bot commented Jan 22, 2026

Uh oh!

coderabbitai Bot commented Jan 22, 2026 •

edited

Loading

Other AI code review bot(s) detected

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Jan 22, 2026

Uh oh!

gemini-code-assist Bot Jan 22, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jan 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Andrei Kvapil (kvaps) commented Jan 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Release note

Summary by CodeRabbit

Uh oh!

gemini-code-assist Bot commented Jan 22, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

coderabbitai Bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Other AI code review bot(s) detected

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Jan 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Andrei Kvapil (kvaps) commented Jan 22, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jan 22, 2026 •

edited

Loading