Bitnami Helm charts moving to OCI

In January 2022, we announced the general availability of Helm charts in OCI registries, coinciding with the release of Helm version 3.8.0. In January 2023, Bitnami began populating and distributing the largest and most up-to-date Open-Source catalog of Helm charts in OCI format in Docker Hub. 

Since then, the adoption of the Bitnami Helm charts in OCI format has proliferated. Because charts stored in container registries follow OCI standards, developers can use many of the same tools for Helm charts that they use with container images. This makes integrating Helm into automated pipelines easier and uses modern infrastructure-as-code and deployment techniques like GitOps.

We would like to go further and help the Helm community to continue adopting the OCI distribution format. Starting November the 18th, 2024, Bitnami Helm charts will default to OCI. All the charts will remain Open Source and publicly available at https://hub.docker.com/u/bitnamicharts.

Why OCI Format?

1. Standardization and Interoperability

The OCI format offers a standardized way to package and distribute container images and related artifacts. This standardization fosters interoperability across different tools and platforms, making it easier for developers and operators to collaborate. By adopting OCI, Helm charts can seamlessly integrate with existing container ecosystems, enhancing compatibility with tools like Docker and container registries.

2. Enhanced Security

The OCI format promotes best practices for image signing and verification, allowing users to validate the integrity of their deployments. By adopting OCI, the Bitnami Helm charts leverage these security features. This ensures that the charts we publish are trustworthy and resilient against vulnerabilities.

3. Improved Distribution

With OCI-compliant registries becoming increasingly prevalent, moving to the OCI format allows for more efficient distribution of Helm charts. Users can store and manage Helm charts alongside container images in a single repository, simplifying workflows and reducing the complexity of multi-repository management.

4. Future-Proofing Our Ecosystem

The cloud-native landscape is dynamic, with new technologies and practices constantly emerging. By transitioning to the OCI format, Bitnami Helm charts are delivered in a way that sets developers up for success in this ever-changing environment.

The move to OCI format is more than just a technical shift; it’s an opportunity for the Helm community to enhance its capabilities, improve security, and simplify our workflows.

What will happen to the current index.yaml stored at charts.bitnami.com?

In order to guarantee a smoother transition, the index.yaml will continue existing as an OCI artifact in Docker Hub. Any users who still use the helm repo add command can continue using this approach to maintain backward compatibility. The Helm tooling manages this in a transparent manner.

The index.yaml will change the “URL” option to point to the new OCI versions of Helm charts:

   urls:

-    - https://charts.bitnami.com/bitnami/airflow-18.3.2.tgz

+   - oci://registry-1.docker.io/bitnamicharts/airflow:18.3.2

Users should not see any change for deploying Helm charts. The requirement is to use a Helm CLI greater than 3.8.0 to deploy them.

What will happen to the Bitnami Helm charts in tgz format?

The Bitnami Helm charts in tgz format will no longer be updated. Previous versions since 2023 are available at Docker Hub and it is easy to get the tgz format via Helm command:

    $ helm pull oci://registry-1.docker.io/bitnamicharts/airflow –version 18.3.2

Older versions will continue to be available at the same URL for 6 months to ensure a smooth transition. Do not hesitate to contact us for any questions or suggestions at https://github.com/bitnami/charts/issues.

Distributing Helm Charts is Now Easier Than Ever with This New Helm Plugin

TL;DR 
Bitnami’s Helm charts (which are available in the VMware Application Catalog as well) can now be moved across OCI repositories with two simple commands - no configuration or extra steps are needed; air gap-friendly. Keep reading to learn more.

Introducing the Distribution Tooling for the Helm OSS project

The distribution tooling for Helm, a.k.a. dt, is a new open source Helm Plugin that distributes a set of utilities for making offline work with Helm charts easier. It is meant to be used for creating reproducible and relocatable packages for Helm charts that can be easily moved across registries without hassles. This is particularly useful for distributing Helm charts into air-gapped environments, which is typically where businesses operating in highly regulated verticals prefer having their software run. 

In its simplest form, dt can be used to create tarballs from any compatible Open Container Initiative(OCI)-compliant Helm chart, like Bitnami’s, with a single command:

# Wrap 
$ helm dt wrap oci://docker.io/bitnamicharts/kibana
  ...
  🎉  Helm chart wrapped into
"/Users/martinpe/workspace/kibana/kibana-10.4.8.wrap.tgz"

And then distribute that tarball into any OCI registry. 

# Unwrap
$ helm dt unwrap kibana-10.4.8.wrap.tgz demo.goharbor.io/helm-plugin/ --yes

  ...
  🎉  Helm chart unwrapped successfully: You can use it now by running "helm install oci://demo.goharbor.io/helm-plugin/kibana --generate-name"

These tarballs or wraps contain not only the Helm Chart and its metadata but also all the container images that you possibly need to run the Helm Chart independently on the configuration values. 

But how does it work?

Automation and standardization come to the rescue. One of the advantages of Bitnami’s Helm charts is that they follow very rigorous standards and practices. All Helm charts are created the same way and share the same characteristics. This makes automation easier. But until now, we have not taken a step in the direction of annotating our Helm Charts with images. Something that a few software providers were already doing and was proposed and approved as a Helm Improvement Process (HIP).

annotations:
  category: MachineLearning
  licenses: Apache-2.0
  images: |
    - name: configurable-http-proxy
      image: docker.io/bitnami/configurable-http-proxy:4.5.6-debian-11-r8
    - name: jupyter-base-notebook
      image: docker.io/bitnami/jupyter-base-notebook:4.0.2-debian-11-r8
    - name: jupyterhub
      image: docker.io/bitnami/jupyterhub:4.0.2-debian-11-r9
    - name: os-shell
      image: docker.io/bitnami/os-shell:11-debian-11-r43

We have fully embraced this proposal and from now on, all Bitnami Helm charts will contain annotations that specify the container images needed by a Helm chart along with the tags (e.g. MongoDB or JupyterHub). But we have gone a step further. In this other Helm Improvement Proposal we have proposed a mechanism to create a lock file that uses the Helm chart image annotations to create a point-in-time snapshot of the Helm chart. This is similar to what many programming languages offer for tracking dependencies. The proposed mechanism brings the ability to capture all the hashes of the container images that a Helm chart might need at a given point in time.

apiversion: v0
kind: ImagesLock
metadata:
  generatedAt: "2023-08-04T13:36:09.398772Z"
  generatedBy: Distribution Tooling for Helm
chart:
  name: mariadb
  version: 13.0.0
images:
  - name: mariadb
    image: docker.io/bitnami/mariadb:11.0.2-debian-11-r2
    chart: mariadb
    digests:
      - digest: sha256:d3006a4d980d82a28f433ae7af316c698738ba29a5a598d527751cb9139ab7ff
        arch: linux/amd64
      - digest: sha256:3ec78b7c97020ca2340189b75eba4a92ccb0d858ee62dd89c6a9826fb20048c9
        arch: linux/arm64
  - name: mysqld-exporter
    image: docker.io/bitnami/mysqld-exporter:0.15.0-debian-11-r5
    chart: mariadb
    digests:
      - digest: sha256:6f257cc719f5bbde118c15ad610dc27d773f80216adabf10e315fbcaff078615
        arch: linux/amd64
      - digest: sha256:e0c141706fd1ce9ec5276627ae53994343ec2719aba606c1dc228f9290698fc1
        arch: linux/arm64
  - name: os-shell
    image: docker.io/bitnami/os-shell:11-debian-11-r22
    chart: mariadb
    digests:
      - digest: sha256:7082ebf5644cf4968ac635986ded132dd308c0b9c13138f093834f343cd47d7b
        arch: linux/amd64
      - digest: sha256:232ca2da59e508978543c8b113675c239a581938c88cbfa1ff17e9b6e504dc1a
        arch: linux/arm64

This file can be used in very fancy and creative ways especially if we think about how it can be integrated into Helm itself but in dt, we have focused on a feature that is among the most demanded by our customers - distribution and relocation. Let’s for example look at an air gap scenario and how dt could be used. 

The above figure shows a typical air gap scenario but with this new tool. An operator would point the dt tool to any Bitnami Helm chart and use it to create a wrap tarball that would then be picked up by an approved operator and taken into the air-gapped zone. From there dt can be pointed to the USB stick and to an OCI registry and will take care of moving the Helm chart along with all the container images, making sure that all references are properly updated so there is never an attempt to obtain images from the outside network. 

What else can I do with this plugin?

Wrapping and unwrapping are the most powerful coarse-grained commands. But this plugin ships with many fine-grained commands as well, which can be used to better customize your distribution flows. Some of the most interesting things that the plugin provides at the time of writing this piece are: 

• Ability to create single-architecture wraps that are lighter to store and distribute.
• Lock a Helm chart by generating the images lock. This has many possibilities to explore like Helm chart reproducibility without needing to use hashes which have many benefits but are obscure.
• Verify a Helm chart against the images lock.
• Relocate any Helm chart. 
• Pull and push images from and to registries. 
• Get information from any Helm chart at the digest level. 

It’s also very important to note that the wrap generation does not only work with simple Helm charts but also with more complex charts that have subchart dependencies. dt takes care of automatically navigating the Helm chart structure and creating the appropriate images lock. Operators are also supported. As long as the Chart ships with annotated images, lock generation as well as distribution and relocation should work independently of the type of application. 

I have many ideas for this! Can I contribute?

Of course, we do welcome contributions! We are very excited about the possibilities that this tool opens and with the prospect of the Helm community starting to test it and reporting any issues, ideas, improvements or directly sending pull requests for enhancements. Start by reading our README, getting familiar with this plugin and trying it yourself. Then feel free to reach out to us through GitHub issues. 

Bitnami Helm Charts Now Generally Available as OCI Packages

In January 2023, the whole Bitnami Helm Charts catalog was made available as OCI Packages for early adopters only. Now, we are happy to make the Bitnami OCI Helm charts catalog generally available in the bitnamicharts DockerHub organization. We are also delighted to announce that OCI Helm charts will be the de facto standard used by Bitnami for distributing the Helm charts.

OCI packages help overcome the many issues typically associated with the traditional method (index.yaml served at https://charts.bitnami.com) of distributing and maintaining a large catalog of Helm charts. So, this move to OCI packages will help us deliver a more robust product and in turn richer user experience.

Making OCI Helm Charts the standard method for distributing and consuming Bitnami Helm charts was enabled by two of our recent milestones:

• The bitnamicharts DockerHub organization joined the Docker Verified Publisher Program

• The OCI Helm Charts are fully integrated into our automated test and release process

Bitnami Helm charts will default to OCI

In order to distribute the Bitnami Helm charts as OCI artifacts in a native way, the source code of the Helm charts will be modified so the Charts documentation and also all dependencies defined in the Chart.yaml/Chart.lock files will be updated to point to the OCI registry. All Bitnami documentation will be updated as well.

What will happen to the current index.yaml stored at charts.bitnami.com?

As part of this move to OCI, we will be deprecating Helm chart consumption via index.yaml. In case, you need to consume Bitnami Helm charts via index.yaml, please note that all such requests from now on will be redirected to a new index.yaml that is generated and stored in a different location, and not in the Bitnami Content Delivery Network (CDN). This change may not be explicitly observable to the users since the content will remain the same, while only the index.yaml will be served from a different location.

We will be moving index.yaml to a reliable CDN but we would like you to note that any possible rate limits that the CDN provider might choose to apply to individual IP addresses consuming Helm Charts at a large scale are out of our control. In addition to this, keeping all the limitations and issues faced when using large Helm chart catalogs in a single index, we strongly recommend users start consuming Helm Charts as OCI packages going forward (although the index will remain available).

Roadmap

April, May and June

• During April, May, and June both distribution methods will coexist in the same way as today (no redirection implemented during this period definitively).

• During those months, the documentation will be updated so the installation instructions reflect the new method. From

helm repo add bitnami https://charts.bitnami.com/bitnami
helm install my-release bitnami/<chart>

to

helm install my-release oci://registry-1.docker.io/bitnamicharts/<chart>

• In the same way, the Helm chart source code present in the bitnami/charts GitHub repository will be updated so the dependencies defined in the Chart.yaml are also fetched as OCI packages
  condition: mariadb.enabled
    name: mariadb
      -repository: https://charts.bitnami.com/bitnami
      +repository: oci://registry-1.docker.io/bitnamicharts
    version: 11.x.x

with that change, the Chart.lock will be updated as well after executing the helm dependency update command
name: mariadb
    -repository: https://charts.bitnami.com/bitnami
    -version: 11.5.4
    +repository: oci://registry-1.docker.io/bitnamicharts
    +version: 11.5.5

This will mean that, regardless of the installation method chosen by the users, all the Helm charts used as dependencies will be fetched automatically as OCI packages.

• During this period, we will perform some planned redirections from the index.yaml stored at https://charts.bitnami.com to the index.yaml stored in a different location. Redirections will be notified timely and accordingly from our community forums.
  The purpose of this action is to redirect different amounts of traffic to detect any kind of issue. For end users, this means the Helm CLI commands or any CI/CD tool will fetch the index.yaml from a different location instead of from the traditional Bitnami repository.

        Provisional dates and test parameters:
    - Traffic redirection 1: 100% of traffic during 4 hours at the end of May
    - Traffic redirection 2: 100% of traffic during 8 hours in mid-June
    - Traffic redirection 3: 100% of traffic during 24 hours at the end of June

July

• In the same way, as described above, during July the index.yaml stored at https://charts.bitnami.com will be redirected to the index.yaml stored in a different location permanently unless some unexpected new issues pop up.

Although we strictly aim to stick to this roadmap, please note that the timeline and the respective action items mentioned above in the roadmap are susceptible to change if we are faced with any unforeseen issues. As usual, we welcome all feedback Please feel free to create an issue in the GitHub repo by accessing this link.

Bitnami Helm Charts Available as OCI Packages for Early Adopters

We are happy to announce that from this moment, the whole Bitnami Helm Charts catalog is available as OCI packages for Early Adopters! 🎉🎉

You can find them in the bitnamicharts DockerHub organization and deploying any Helm chart should be as simple as running the following command, for instance in the case of the bitnami/postgresql Helm Chart:

helm install my-release oci://registry-1.docker.io/bitnamicharts/postgresql

These Helm charts are 100% OCI-compliant, which means subcharts are also fetched from DockerHub in OCI format.

Why for Early Adopters?

As of now, Helm Charts are pushed to the OCI registry as an experimental catalog independent of our 'official' Helm Charts. We would like to get your feedback before proceeding to fully migrate to OCI.

Because of that, the update cadence is different from the one followed to update the index.yaml stored at https://charts.bitnami.com/, being the index.yaml the official and most updated method for distributing Helm Charts.

What's next?

See below what our plan in the short term is in relation to this new way of distributing Helm Charts:

• The bitnamicharts DockerHub organization will be part of the Docker Verified Publisher Program.

• The OCI Helm Charts available at the bitnamicharts DockerHub organization will be fully included in our automated release process. From that moment, we will consider Bitnami OCI Helm Charts as the production-grade method for distributing and consuming Helm Charts.

Regarding the long term plan, our roadmap is to use OCI packages as the only source of truth, removing the index.yaml stored at https://charts.bitnami.com/.

These changes will be properly announced with specific dates in the future and always giving enough time for our community to migrate. Once the Bitnami OCI Helm Charts catalog is considered production-ready, the Helm Charts in OCI format and the index.yaml will coexist during some months, but the latter will eventually be deprecated.

Useful links

• Use OCI-based registries

• Storing Helm Charts in OCI Registries

• Announcing Docker Hub OCI Artifacts Support

💬 Any feedback is welcomed from those of you using those OCI packages while we work on the pending steps to make the registry production-ready.

Bitnami Partners with Oracle to Expand Services for End Users

To kick off Oracle OpenWorld, we wanted to provide the Bitnami community with an update on all of the things we have been doing with Oracle!

Bitnami has provided Oracle with up-to-date and secure images on the Oracle Cloud Marketplace for over two years, which has led to the expansion of the relationship as Oracle continues to provide more and more options for users to test the power of their cloud infrastructure. Now, we are proud to announce that you can enjoy the security and consistency of Bitnami applications within Oracle’s new solutions and training environments mentioned below.

Our solutions allow you to demo our applications quickly, get training with hands-on exercises, and then easily deploying a production ready application to further your testing needs. Pick the option that suits your needs best.

Easily Demo Apps with Oracle Cloud Jump Start Demo Labs:

Test the power of the Oracle Cloud Infrastructure for free with the new Oracle Cloud Jump Start Demos. You’ll be able to try a pre-configured Bitnami Demo Lab within a matter of minutes, which will give you a glimpse into the possibilities that the Oracle Cloud can bring your team.

Get started with the JumpStart Demo Labs below:

• SonarQube Certified by Bitnami 
• Redmine Certified by Bitnami
• Jenkins Certified by Bitnami

Educate Yourself with Oracle Jump Start Learning Labs:

These Self Paced Labs will give you the ability to learn about the Oracle Cloud Infrastructure while using one of the familiar Bitnami applications as the basis for your course. In these 1 hour courses, you’ll be able to launch an application, test the OCI features, and explore at your own pace with hands-on exercises. Get started today with Jenkins or Sonarqube.

Evaluate with the Power of Production-Ready Jump Start Launch:

Spin up a Jump Start Launch Image or Launch Stack for the full production experience as you continue your testing. The Jump Start Launch program provides great reliability and a solid foundation for your proof-of-concept. These deployment options will give your team the opportunity to evaluate the combination of the application’s features with the power of the Oracle Cloud Infrastructure without having to build everything from scratch.

• RabbitMQ Certified by Bitnami 
• MySQL Certified by Bitnami 
• SonarQube Certified by Bitnami 
• MongoDB Certified by Bitnami 
• Jenkins Certified by Bitnami 

Partner Image Catalog

The Oracle Cloud Marketplace will now be included within your Oracle Cloud Infrastructure console. In addition to this, Oracle has also added the ability to launch applications directly on your environment via a Partner Image Catalog.

Before the Partner Image Catalog, it could take days or weeks to spin up an application on your servers, but now it will only take you a few moments. The click-to-deploy option now gives you the freedom to get started with your Bitnami projects quickly and efficiently.

Login into your OCI console now, and check it out!

Production Ready Multi-Tier Applications

Bitnami Multi-Tier templates are now available in the Oracle Cloud Infrastructure. These Terraform architecture templates allow you to easily move your deployments from development to production while providing high availability and performance in medium/large size production environments.

Follow our guide as we walk you through the process of using the Terraform Provider plugin and the Terraform CLI to deploy the Bitnami MySQL with replication on an Oracle Cloud Infrastructure server. The guide will teach you how to configure the Terraform CLI, the OCI plugin and how to configure it with your OCI account for the best performance of your new Multi-Tier application.

See how easy it is to deploy Jenkins using a Terraform template below:

Check out the step-by-step tutorials for your use case below:

• Add Robust, Scalable Messaging to your Application with Bitnami's RabbitMQ Terraform Template for Oracle Cloud
• Deploy a Scalable MongoDB Replica Set on Oracle Cloud with Bitnami's MongoDB Terraform Template

Kubeapps on OKE

Kubeapps is a web-based UI for deploying and managing applications in Kubernetes clusters, which can now be used on OKE clusters to get access to hundreds of Helm apps.

The Bitnami Kubernetes team has been working hard to ensure that the Kubeapps experience on top of OKE clusters provides the same ease of use that you’ll find when running it on any other cluster.

Learn how to get started with our guide here.