Starting August 28, 2025, access to ready-to-deploy container images from Bitnami have been restricted unless users opt for a paid plan or compile them independently from source code. This change affects our current use of helm charts and therefore containers sourced from Bitnami for both `Arko` and `Tarook`. There are issues for this at Tarook [Issue #799](https://gitlab.com/alasca.cloud/tarook/tarook/-/issues/799) and [Issue #112](https://github.com/dNationCloud/kubernetes-monitoring-stack/issues/112) at Arko. Both projects switched to `bitnamilegacy/thanos` for now which is **not maintained** any longer - so we need a lasting solution ASAP. Several [options](https://gitlab.com/alasca.cloud/tarook/tarook/-/issues/799) have been already evaluated and deemed unsuitable either by the TSC and/or developer side. There are problems with adding new projects without a proper maintenance strategy or by deployment of privately owned repos in secure and trusted environments. After a meeting between Arko, Tarook and FOCIS a new and much simpler approach has been proposed: Since the Bitnami Chart repository is still under [Apache 2.0](https://github.com/bitnami/charts/blob/main/LICENSE.md) we can simply move the build step into the ALASCA domain. The Thanos image would need to be switched to the [upstream image](https://hub.docker.com/r/thanosio/thanos/tags) provided by Thanos (Apache 2.0). We would propose to create a subgroup/project `alasca.cloud/charts-and-container/charts/thanos` where we build the chart within a simple pipeline like so (beware AI generated to proof the concept): ``` image: alpine/helm:latest variables: CHART_NAME: "thanos" BITNAMI_REPO: "https://github.com/bitnami/charts.git" # Custom image settings THANOS_REGISTRY: "docker.io" THANOS_REPOSITORY: "thanosio/thanos" THANOS_TAG: "v0.35.1" stages: - build - publish build_chart: stage: build script: # Clone Bitnami charts repo - apk add --no-cache git - git clone --depth 1 ${BITNAMI_REPO} # Extract Thanos chart - cp -r charts/bitnami/${CHART_NAME} . # Modify values.yaml to use thanosio/thanos image - | sed -i "s|registry:.*|registry: ${THANOS_REGISTRY}|g" ${CHART_NAME}/values.yaml sed -i "s|repository:.*bitnami/thanos|repository: ${THANOS_REPOSITORY}|g" ${CHART_NAME}/values.yaml sed -i "s|tag:.*|tag: ${THANOS_TAG}|g" ${CHART_NAME}/values.yaml # Update chart version to indicate customization - sed -i 's|version:.*|version: 1.0.0-custom|g' ${CHART_NAME}/Chart.yaml # Package the chart - helm dependency update ${CHART_NAME} - helm package ${CHART_NAME} artifacts: paths: - "*.tgz" expire_in: 1 day publish_chart: stage: publish needs: - build_chart script: # Upload to GitLab Package Registry - | curl --request POST \ --form "chart=@$(ls *.tgz)" \ --user gitlab-ci-token:${CI_JOB_TOKEN} \ "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts" only: - main - tags ``` We would trigger this by renovate to run every time Bitnami publishes a [new release](https://github.com/bitnami/charts/releases/tag/thanos%2F17.4.0). As registry we propose the [Gitlab Helm Chart repository](https://docs.gitlab.com/user/packages/helm_repository/) as shown above. Tarook already said, that they will add some human capital to it. FOCIS also can help setup and maintain this project, but only until project end this year. As there has been a discussion in the past, I would like to hear what the TSC thinks about this proposal. Did we miss something? Is there any problem with licenses? --- Related: https://gitlab.com/alasca.cloud/tarook/tarook/-/issues/799#note_3040087371