Fix/migrate away from bitnamilegacy

.github/ct.yaml

@@ -1,4 +1,2 @@
-chart-repos:
-  - bitnami=https://charts.bitnami.com/bitnami
 target-branch: main
 check-version-increment: false

.github/workflows/helm-chart-lint-test.yaml

@@ -42,6 +42,44 @@ jobs:
         if: steps.list-changed.outputs.changed == 'true'
         run: ct lint --config .github/ct.yaml
 
+      # `helm lint` does NOT enforce the chart's own guards. On Helm 4 a
+      # template `fail` surfaces as `level=INFO msg="funcMap fail"` and lint
+      # still exits 0 -- verified on Helm 4.2.3. So a values file carrying stale
+      # Bitnami keys, or a Bitnami image, would pass `ct lint` untouched.
+      # `helm template` does fail, so gate on that.
+      - name: Render guards (helm template, which lint cannot enforce)
+        if: steps.list-changed.outputs.changed == 'true'
+        run: |
+          set -euo pipefail
+          helm template ci charts/nebraska > /dev/null
+          helm template ci charts/nebraska \
+            --set postgresql.primary.persistence.enabled=true > /dev/null
+
+          # Each of these MUST fail. If one starts passing, a guard has regressed.
+          for bad in \
+            "postgresql.metrics.enabled=true" \
+            "postgresql.image.repository=bitnamilegacy/postgresql" \
+            "postgresql.primary.resources.limits.memory=4Gi" ; do
+            if helm template ci charts/nebraska --set "$bad" > /dev/null 2>&1; then
+              echo "::error::guard regression: --set $bad should have been rejected"
+              exit 1
+            fi
+          done
+
+          # The data-directory guard is upgrade-only.
+          if helm template ci charts/nebraska --is-upgrade \
+               --set postgresql.primary.persistence.enabled=true > /dev/null 2>&1; then
+            echo "::error::guard regression: persistent upgrade without acknowledgement was allowed"
+            exit 1
+          fi
+
+          # Values left at Bitnami defaults must NOT be rejected, so that
+          # vendoring the old values.yaml wholesale still installs.
+          helm template ci charts/nebraska \
+            --set postgresql.architecture=standalone \
+            --set postgresql.metrics.enabled=false \
+            --set postgresql.tls.enabled=false > /dev/null
+
       - name: Create kind cluster
         uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
         if: steps.list-changed.outputs.changed == 'true'

.github/workflows/helm-chart-release.yml

@@ -32,10 +32,6 @@ jobs:
         with:
           version: v3.12.1
 
-      - name: Add Helm repos
-        run: |
-          helm repo add bitnami https://charts.bitnami.com/bitnami
-
       - name: Run chart-releaser
         uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
         env:

CHANGELOG.md

@@ -16,6 +16,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ### Changed
 
+- **helm/postgresql: the default superuser password is now generated, not `changeIt`.** `postgresql.auth.postgresPassword` defaults to `""` and the chart generates a random 24-character password on first install, keeping any value already in the cluster across upgrades. This restores what the Bitnami subchart did before chart 2.0.0 replaced it with a fixed default. Retrieve it with `kubectl get secret <release>-postgresql -o jsonpath='{.data.postgres-password}' | base64 -d`. Anyone relying on the published default must set `postgresql.auth.postgresPassword` explicitly or use `postgresql.auth.existingSecret`.
+- **helm/postgresql: unknown `postgresql.*` values are now rejected at render time instead of being silently ignored.** Removing the subchart dropped roughly 55 keys; a values file carrying them would previously have installed cleanly with the settings discarded. Expect around twenty reports on the first upgrade if you vendored the upstream Bitnami `values.yaml`; each names the replacement key. Values left at their Bitnami defaults are accepted silently.
+
+- **helm: replaced the Bitnami PostgreSQL subchart with an in-chart StatefulSet on the official `postgres` image.** The chart no longer depends on `https://charts.bitnami.com/bitnami` and no longer ships a `bitnamilegacy/*` image, so the bundled database gets security patches again. This is a **breaking change for installs with `postgresql.primary.persistence.enabled: true`**: the data directory moves inside the volume. You have two options. If you stay on the same PostgreSQL major version you can reuse the volume in place, no dump needed, see the tested procedure in the chart README "Upgrading to 3.0.0". Otherwise, and always across major versions, use `pg_dump` and restore. Nebraska itself is restarted by the upgrade, through a pod template annotation, so it runs its schema migrations again against the database it now points at. Installs using an external database (`postgresql.enabled: false`) or the default ephemeral database need no action. Chart version bumped to 3.0.0. ([#1574](https://github.com/flatcar/nebraska/issues/1574), [#1148](https://github.com/flatcar/nebraska/issues/1148))
+
 - **Per-group runtime state moved to node-local `group_local` sidecar:** `rollout_in_progress` plus a nullable override column for each `policy_*` column on `groups` now live on a new `group_local` table, in preparation for the distributed Nebraska topology described in [RFC #1375](https://github.com/flatcar/nebraska/issues/1375). The safe-mode auto-pause brake writes the local override instead of mutating the admin default; reads return `COALESCE(override, default)`. The JSON contract is unchanged. ([#1396](https://github.com/flatcar/nebraska/pull/1396))
 - **Activity events split across runtime-local and admin tables:** Admin-originated activity events (channel package updates) are now stored in a separate `admin_activity` table, in preparation for the distributed Nebraska topology described in [RFC #1375](https://github.com/flatcar/nebraska/issues/1375). The JSON contract is unchanged. ([#1398](https://github.com/flatcar/nebraska/pull/1398))
 - **Package Management UI Improvements:**
@@ -24,6 +29,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
   - Channel edit dialog filters out blacklisted packages from selection
   - Floor package selection prevents choosing blacklisted packages with clear visual feedback
 ### Removed
+
+- **helm/postgresql: the `password` key is removed from the `<release>-postgresql` Secret.** The Bitnami subchart emitted both `postgres-password` (superuser) and `password` (a separate app user); this chart has a single superuser and emits only `postgres-password`. Helm deletes the missing key on upgrade, so anything reading it, for example backup jobs or external tooling, must be repointed **before** upgrading.
+
 ### Bugfixes
 
 - Fixed package blacklist changes not appearing in UI immediately after save

charts/nebraska/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: nebraska
 description: Nebraska is an update manager for Flatcar Container Linux.
 type: application
-home: https://github.com/flatcar/nebraska/tree/main/deploy/helm
+home: https://github.com/flatcar/nebraska/tree/main/charts/nebraska
 icon: https://raw.githubusercontent.com/flatcar/nebraska/main/docs/nebraska-logo.svg
 keywords:
   - nebraska
@@ -18,11 +18,33 @@ sources:
 maintainers:
   - name: flatcar
     url: https://flatcar.org/
-version: 2.0.0
+
+# 2.0.0 -> 3.0.0: MAJOR, because the bundled PostgreSQL changed image, data
+# directory layout and uid. Installs with persistence enabled need a dump and
+# restore; see "Upgrading to 3.0.0" in README.md.
+version: 3.0.0
 appVersion: "3.0.0"
 
-dependencies:
-  - name: postgresql
-    version: 11.9.1
-    repository: https://charts.bitnami.com/bitnami
-    condition: postgresql.enabled
+# There is deliberately no `dependencies:` block, and Chart.lock is deleted.
+#
+# 2.0.0 depended on postgresql 11.9.1 from https://charts.bitnami.com/bitnami.
+# Bitnami retired its free catalogue on 2025-08-28: images moved to the frozen
+# docker.io/bitnamilegacy archive (never rebuilt, so every CVE since then is
+# unpatched) and the classic chart repo is deprecated with no committed shutdown
+# date. Those are flatcar/nebraska#1574 and #1148 respectively, and they are the
+# same root cause, so this chart fixes them together by vendoring a small
+# StatefulSet instead of swapping one external dependency for another.
+#
+# Alternatives considered:
+#   - Keep the subchart, point image.repository at docker.io/postgres. Does not
+#     work: the Bitnami templates set POSTGRESQL_* env vars, mount /bitnami, and
+#     run a Bitnami-specific entrypoint.
+#   - Adopt a maintained third-party postgres subchart (CloudPirates is the one
+#     the ecosystem converged on; Superset, docker-selenium and Opik all moved
+#     to it). Rejected here to avoid trading one external chart
+#     dependency for another for what is only a convenience database.
+#   - Require an operator such as CloudNativePG. Rejected as a default: it needs
+#     cluster-scoped CRDs installed before this chart can render at all. It
+#     remains the recommendation for production, via postgresql.enabled=false.
+#
+# Vendoring is what the closest comparable migration (helixml/helix#1890) did.