TT-16204 Migrate from legacy Bitnami containers

[caroltyk]

PR Type

Documentation

---

Description

• Add image override for Bitnami Redis

• Add image override for Bitnami PostgreSQL

• Add image override for Bitnami MongoDB

• Update Helm examples across docs

---

Diagram Walkthrough

flowchart LR
  Docs["Docs: Helm install snippets"] -- "add --set image.repository=bitnamilegacy/*" --> Redis["Redis examples"]
  Docs -- "add --set image.repository=bitnamilegacy/*" --> Postgres["PostgreSQL examples"]
  Docs -- "add --set image.repository=bitnamilegacy/*" --> Mongo["MongoDB examples"]

Loading

File Walkthrough

Relevant files

Documentation

9 files logs-metrics.mdx Add Redis image.repository override in Helm command            +1/-1      mdcb.mdx Add Redis and PostgreSQL image overrides in steps                +3/-3      tyk-pump.mdx Add Redis image.repository override in OSS examples            +2/-2      installation.mdx Add Redis image override in install commands                          +2/-2      tyk-control-plane-chart.mdx Add Redis, MongoDB, PostgreSQL image overrides                      +3/-3      tyk-data-plane-chart.mdx Add Redis image override in DP chart docs                                +1/-1      tyk-oss-chart.mdx Add Redis, MongoDB, PostgreSQL image overrides                      +3/-3      tyk-stack-chart.mdx Add Redis, MongoDB, PostgreSQL image overrides                      +3/-3      hybrid-gateways.mdx Add Redis image override in hybrid examples                            +2/-2

---

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Consistency Ensure all Redis/PostgreSQL/MongoDB Helm snippets consistently use either OCI registry or chart repo syntax and include the same namespace flags; some places switched to OCI upgrade while others still show helm install from bitnami repo, which may confuse users. helm upgrade tyk-redis oci://registry-1.docker.io/bitnamicharts/redis -n $NAMESPACE --install --version 19.0.2 --set image.repository=bitnamilegacy/redis ``` Follow the notes from the installation output to get connection details and password. The DNS name of your Redis as set by Bitnami is `tyk-redis-master.tyk-cp.svc:6379` (Tyk needs the name including the port) The Bitnami chart also creates a secret `tyk-redis` which stores the connection password in `redis-password`. We will make use of this secret in installation later. <Note> Ensure that you are installing Redis versions that are supported by Tyk. Please consult the list of [supported versions](/tyk-self-managed/install#redis) that are compatible with Tyk. </Note> 3. **Install PostgreSQL (if you don't already have PostgreSQL installed)** If you do not already have PostgreSQL installed, you may use these charts provided by Bitnami. ```bash helm upgrade tyk-postgres oci://registry-1.docker.io/bitnamicharts/postgresql --set "auth.database=tyk_analytics" -n $NAMESPACE --install --version 14.2.4 --set image.repository=bitnamilegacy/postgresql Image Override Scope Confirm that setting image.repository alone is sufficient for these Bitnami charts; some charts may also require image.registry/image.tag to fully pin to legacy images and avoid mixing registries. helm install tyk-mongo bitnami/mongodb --set "replicaSet.enabled=true" -n tyk --version 15.1.3 --set image.repository=bitnamilegacy/mongodb Then follow notes from the installation output to get connection details and update them in values.yaml file. Bitnami MongoDB image is not supported on darwin/arm64 architecture. Please make sure you are installing MongoDB versions that are supported by Tyk. Please refer to Tyk docs to get list of [supported versions](/api-management/dashboard-configuration#supported-database). Important Note regarding MongoDB: This helm chart enables the PodDisruptionBudget for MongoDB with an arbiter replica-count of 1. If you intend to perform system maintenance on the node where the MongoDB pod is running and this maintenance requires the node to be drained, then this action will be prevented due to the the replica count being 1. Increase the replica count in the helm chart deployment to a minimum of 2 to remedy this issue. Configure global.mongo.mongoURL and global.storageType as below. You should replace pass in the connection string with the MONGODB_ROOT_PASSWORD you obtain from the installation output notes. global: # Set mongo connection details if you want to configure mongo pump. mongo: # The mongoURL value will allow you to set your MongoDB address. # Default value: mongodb://mongo.{{ .Release.Namespace }}.svc:27017/tyk_analytics # mongoURL: mongodb://mongo.tyk.svc:27017/tyk_analytics # If your MongoDB has a password you can add the username and password to the url mongoURL: mongodb://root:[email protected]:27017/tyk_analytics?authSource=admin # mongo-go driver is supported for Tyk 5.0.2+. # We recommend using the mongo-go driver if you are using MongoDB 4.4.x+. # For MongoDB versions prior to 4.4, please use the mgo driver. # Since Tyk 5.3 the default driver is mongo-go. driver: mongo-go # Connection URL can also be set using a secret. Provide the name of the secret and key below. # connectionURLSecret: # name: "" # keyName: "" # Enables SSL for MongoDB connection. MongoDB instance will have to support that. # Default value: false useSSL: false # Choose the storageType for Tyk. [ "mongo", "postgres" ] storageType: &globalStorageType mongo PostgreSQL Installation helm install tyk-postgres bitnami/postgresql --set "auth.database=tyk_analytics" -n tyk --version 12.12.10 --set image.repository=bitnamilegacy/postgresql </details> <details><summary><a href='https://github.com/TykTechnologies/tyk-docs/pull/1047/files#diff-0db01cd5d67a0e4bf927feb1307fccf61b0356dc7b07b0c1125e3f2be8cb90eaR1379-R1385'><strong>Version Variable Parity</strong></a> Where REDIS_BITNAMI_CHART_VERSION is parameterized, consider parameterizing PostgreSQL/MongoDB chart versions similarly to keep examples maintainable and avoid divergent hard-coded versions. </summary> ```txt REDIS_BITNAMI_CHART_VERSION=19.0.2 helm upgrade tyk-redis oci://registry-1.docker.io/bitnamicharts/redis -n $NAMESPACE --create-namespace --install --version $REDIS_BITNAMI_CHART_VERSION --set image.repository=bitnamilegacy/redis helm upgrade tyk-otel tyk-helm/tyk-oss -n $NAMESPACE --create-namespace \ --install \ --set global.secrets.APISecret="$APISecret" \ --set tyk-gateway.gateway.image.tag=$TykVersion \

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
General	Specify image registry explicitly When overriding the repository, also set the full image registry to ensure Helm doesn't resolve to Docker Hub implicitly, which can break in air-gapped or mirrored environments. Provide image.registry explicitly alongside the legacy repository override. product-stack/tyk-charts/tyk-oss-chart.mdx [415] -helm install tyk-mongo bitnami/mongodb --set "replicaSet.enabled=true" -n tyk --version 15.1.3 --set image.repository=bitnamilegacy/mongodb +helm install tyk-mongo bitnami/mongodb -n tyk --version 15.1.3 \ + --set replicaSet.enabled=true \ + --set image.registry=docker.io \ + --set image.repository=bitnamilegacy/mongodb Suggestion importance[1-10]: 6 __ Why: The existing line at 415 matches and adding image.registry can help in air‑gapped setups; the change is low risk and improves clarity, though not critical to functionality.	Low
	Align securityContext with legacy image Ensure compatibility with chart defaults that expect non-root containers by mirroring securityContext changes tied to legacy images. Explicitly set containerSecurityContext.enabled=true and runAsUser, runAsNonRoot, and fsGroup to values supported by the legacy image. api-management/logs-metrics.mdx [1381] -helm upgrade tyk-redis oci://registry-1.docker.io/bitnamicharts/redis -n $NAMESPACE --create-namespace --install --version $REDIS_BITNAMI_CHART_VERSION --set image.repository=bitnamilegacy/redis +helm upgrade tyk-redis oci://registry-1.docker.io/bitnamicharts/redis -n $NAMESPACE --create-namespace --install --version $REDIS_BITNAMI_CHART_VERSION \ + --set image.repository=bitnamilegacy/redis \ + --set containerSecurityContext.enabled=true \ + --set containerSecurityContext.runAsNonRoot=true \ + --set containerSecurityContext.runAsUser=1001 \ + --set podSecurityContext.fsGroup=1001 Suggestion importance[1-10]: 4 __ Why: The target line 1381 matches, and setting security contexts may help with legacy images, but the suggested values are speculative and not derived from the PR; risk of being incorrect for the Bitnami chart reduces its reliability and impact.	Low
Possible issue	Pin container image tag Pin the image tag to the chart's Redis version to avoid pulling a mismatched legacy image that may be incompatible with the chart defaults. Explicitly set image.tag to the version deployed by the chart series you reference. api-management/mdcb.mdx [289] -helm upgrade tyk-redis oci://registry-1.docker.io/bitnamicharts/redis -n $NAMESPACE --install --version 19.0.2 --set image.repository=bitnamilegacy/redis +helm upgrade tyk-redis oci://registry-1.docker.io/bitnamicharts/redis -n $NAMESPACE --install --version 19.0.2 --set image.repository=bitnamilegacy/redis --set image.tag=7.2.4-debian-12-r0 Suggestion importance[1-10]: 5 __ Why: The existing code line at 289 matches and pinning the image tag can improve reproducibility, but the specific tag 7.2.4-debian-12-r0 is asserted without justification from the PR context and may not align with the chart version, limiting confidence and impact.	Low