Upcoming changes to the Bitnami catalog (effective August 28th, 2025)

[sjedlick]

With the note bitnami/charts#35164, Bitnami announces the end of the Bitnami public catalog. Since DefectDojo also uses some Bitnami charts (Redis, Postgres) that currently point to the public catalog, the question arises as to whether Defectdojo will use its own charts for Redis and Postgres in the future?

Thank you
Swen

[c-goosen]

This will affect a couple of things in the Kuberentes and docker and docker-compose setup.
Quick search:

• docker.io/bitnami/redis
• docker.io/bitnami/postgres

Bitnami has accounted for legacy migrations with this, but not all tags are copied over yet: https://hub.docker.com/r/bitnamilegacy/postgresql/tags

This might cause major issues in defect-dojo upgrades of earlier versions.

[c-goosen]

Bitnami is moving to this setup -> https://hub.docker.com/u/bitnamisecure, but this would not allow targeting specific postgresql versions.

[niklasweimann]

Could you please clarify the strategy for dependencies?

My understanding is that defectdojo will switch to the bitnamilegacy repository and then awaiting a drop-in replacement. If this is accurate, does it imply that we won't receive any updates for these dependencies until the replacement is available?

[valentijnscholten]

What would be your suggestion?

We're still looking at the options. We expected some alternatives may pop-up, it looks like Cloudpirates is setting up an alternative: https://www.cloudpirates.io/knowledge/blog/bitnami-helm-charts-was-sich-ab-august-2025-aendert-und-was-du-jetzt-tun-solltest-
Also Redis I think provides their own helm chart.

For the short term we may either switch to the bitnami legacy repo to at least have versioned charts. Or we may use the bitnami secure repo which only has latest tags.

The helm chart is a community supported deployment method so help is welcome.

[yo-l1982]

Some alternatives for redis.
https://artifacthub.io/packages/helm/dandydev-charts/redis-ha
Is used by ArgoCD and seems to be a stable chart(But HA).
Also dragonflydb is a drop in replacement for redis that is interesting.
https://www.dragonflydb.io/docs/getting-started/kubernetes

Sadly not much postgres other than bitnami.

[d-mankowski-synerise]

Sadly not much postgres other than bitnami.

There is CloudNativePG, although, it might be an overkill for such small PostgreSQL instance

[kiblik]

I would

• start to use bitnamisecure
• apply digest pining
• add announcement "Because XY, DD is currently not able to provide the database and the message broker following 'product-ready' best practice. But the solution is working. We are working on a more suitable solution."
• release this via a bugfix (because we need some pinning at the beginning of next week (deadline is Aug 28th)), but as a minor (not a patch) helm release - because it is a larger change for the chart

It would buy us some time. And we can prepare a more stable solution.

[yo-l1982]

Cloudpirates is supplying a new maintained helm chart for postgres supposedly as a response to butnami.
Might be worth keeping an eye on this.
https://artifacthub.io/packages/helm/cloudpirates-postgres/postgres

[kiblik]

Cloudpirates is supplying a new maintained helm chart for postgres supposedly as a response to butnami. Might be worth keeping an eye on this. https://artifacthub.io/packages/helm/cloudpirates-postgres/postgres

I was trying to use CloudPirates #13019, but they have an issue there (HTTP 401).
You are able to use helm install or helm pull, but you are not able to use helm dependency build, which is needed as soon as you are using dependencies.

[fernandezcuesta]

Regarding redis-ha, I tried to use that not so long ago with DefectDojo and IIRC was unable to make it run with TLS... will give it another try and let you know in case of useful findings

[kiblik]

Cloudpirates is supplying a new maintained helm chart for postgres supposedly as a response to butnami. Might be worth keeping an eye on this. https://artifacthub.io/packages/helm/cloudpirates-postgres/postgres

I was trying to use CloudPirates #13019, but they have an issue there (HTTP 401). You are able to use helm install or helm pull, but you are not able to use helm dependency build, which is needed as soon as you are using dependencies.

Ok, I found the reason CloudPirates-io/helm-charts#3 (comment)
And it works now: #13019
However, I'm not sure if it will be able to use the original PVC for PostgreSQL. I might disconnect it and continue with a fresh new DB.

[dhemeier]

Hi,

I saw the reference in our issue and wanted to give you a quick update.

We are currently migrating our internal Helm charts from Bitnami to CloudPirates Charts. Based on our testing, most Bitnami Persistent Volume Claims (PVCs) can be reused without issues. However, the PostgreSQL setup in the Bitnami image differs slightly.

PostgreSQL Migration Details
Always create a backup (i.e. via Velero) before following along this guide. We recommend two migration approaches:

1. Using pg_dump (Recommended):

   • Create a backup using pg_dump on your current Bitnami PostgreSQL instance.
   • Deploy the new PostgreSQL instance using CloudPirates Charts.
   • Restore the backup into the new instance.

2. Reusing the Bitnami PVC:
   Our chart requires the Persistent Volume (PVC) to be mounted at var/lib/postgresql/data. In the Bitnami chart, the PVC is typically mounted at /bitnami/postgresql and contains two subdirectories: /data (where all PostgreSQL data is stored) and /conf.

   • On your existing Bitnami PVC, only the content inside the /data directory needs to be retained.
   • Prepare a new PVC (or clean the existing one) so that its root contains only the contents of the old /data directory, not the /conf directory or any other subfolders.
   • Mount this PVC via persistence.existingClaim in the CloudPirates chart deployment.
   • By following this, your PostgreSQL data will be available under the correct directory layout required by our chart. Any configuration files from /conf in Bitnami are not needed and can be ignored.

On Monday, we’ll publish a detailed blog post and add a step-by-step migration guide to the Charts README to further support your migration from Bitnami charts.

Last I would like to mention, that we have planned an "automated migration script" in our chart for existing Bitnami users. But I would expect that this will not be available in time of the deadline of Bitnami.

Best regards,
Dennis

[rossops]

FYI, for a temporary period, Defectdojo will be vendoring the charts and images in our own public repo. This will ensure full compatibility and accessibility of these resources. Long term, we can choose a 3rd party provider once the dust settles.