fix: replace Bitnami dependencies with official upstream charts by Copilot · Pull Request #593 · api-platform/demo

Copilot · 2026-02-05T15:12:44Z

❓ Why

Bitnami Helm charts now sit behind a paywall (OCI registry requiring a subscription). This blocks CI/CD pipelines and prevents fresh helm dependency build from completing without paid credentials.

This PR finishes the work started in #553 to make the Helm chart 100% independent of Bitnami, using only free, upstream alternatives.

📝 Changes

external-dns: custom template → official chart

Removed the 110-line hand-written external-dns-deployment.yaml (Deployment, ServiceAccount, RBAC, Secret)
Added the official external-dns chart 1.20.0 from kubernetes-sigs as a subchart dependency in Chart.yaml
Restructured values.yaml external-dns: section to match the official chart schema (provider.name, env, sources, policy, etc.)
Updated deploy.yml and ci.yml workflows: replaced helm repo add stable https://charts.helm.sh/stable/ with the external-dns repo, and updated --set flags to match the official chart's values schema

Keycloak deployment: 5 bug fixes

Duplicate KC_BOOTSTRAP_ADMIN_USERNAME: removed the unconditional block that incorrectly pointed to the keycloak-database-password secret; the conditional block (when createAdminUser is true) is the correct one
extraEnvVars nil guard: wrapped with {{- with }} to avoid rendering errors when extraEnvVars is not set
Dead keycloak.image.registry in values.yaml: removed (deploy.yml passes the full path via --set keycloak.image.repository=...)
Broken health probes: changed from GET / on port http (8080) to Keycloak's management endpoints on port api (9000): /health/live, /health/ready, /health/started (startup probe)
Replicas tied to API autoscaling: replaced with replicas: 1 (see note below)

ConfigMap fix

Removed | b64enc from the else branch of keycloak-database-url — a ConfigMap must not contain base64-encoded values

Chart version

Restored version and appVersion to 4.3.0 (was incorrectly downgraded to 4.2.15)

⚠️ Important: Keycloak replicas

Keycloak replicas are hardcoded to 1. This is intentional and required by the current architecture:

PostgreSQL runs as a sidecar container inside the Keycloak pod (not as a shared external database). The KC_DB_URL points to localhost:5432. Scaling to 2+ replicas would create separate isolated PostgreSQL instances per pod — users, sessions, and realms would diverge immediately, causing data corruption.

Keycloak's embedded Infinispan can form a cluster between nodes, but it only replicates in-memory caches, not database writes. Without a shared database, multi-replica Keycloak is broken by design.

To enable HA Keycloak (2+ replicas), the prerequisite is to externalize PostgreSQL (dedicated StatefulSet, CloudSQL, etc.) so all Keycloak pods share a single database. This is out of scope for this PR.

Note from @vincentchalamon: additionally, this project is a simple demo, there is no need to override its architecture and infrastructure. A single Keycloak replica with a single database is more than enough for a demo!

helm/api-platform/templates/external-dns-deployment.yaml

# Conflicts: # helm/api-platform/Chart.lock # helm/api-platform/Chart.yaml

Co-authored-by: vincentchalamon <407859+vincentchalamon@users.noreply.github.com>

- Add missing 'start' subcommand to Keycloak args (kc.sh requires it) - Replace CNPG PostgreSQL image with standalone postgres:16-alpine for sidecar - Fix E2E password selector for Keycloak 26.4 (getByRole instead of getByLabel) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…smatch - Guard KC_BOOTSTRAP_ADMIN_* env vars on non-empty adminPassword to prevent crash when keycloak-admin-password secret is not set in PR environments - Add --optimized flag to skip rebuild check on every start - Add build-time options to Dockerfile (--db, --http-relative-path, --health-enabled, --metrics-enabled) to match runtime config - Remove redundant build-time env vars from deployment template Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…p failure Keycloak with --optimized checks that no provider JARs changed after the build. The JAR was copied after the build step, making its timestamp newer than the build artifacts and causing Keycloak to refuse startup. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…nv vars KC_PRODUCTION=true is a Bitnami-specific env var ignored by the official image. Keycloak start (production mode) requires TLS or http-enabled=true. Since TLS is terminated at the nginx ingress, enable HTTP and configure the proxy headers to trust X-Forwarded-* headers from the ingress. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…ment port The --http-relative-path build option also affects the management interface (port 9000). Health endpoints are at /<relative-path>/health/* not /health/*. Confirmed: /oidc/health/started returns 200, /health/started returns 404. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

The k6 post-deploy check verifies that http:// redirects to https:// with a 301. ssl-redirect was set to false, preventing nginx from issuing the redirect. cert-manager provisions a valid TLS certificate on GKE so the redirect is safe. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…t trailing slash nginx-ingress uses 308 (not 301) for ssl-redirect to preserve HTTP method. The Location header for root path omits the trailing slash. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

@claude

* chore: replace bitnami/postgresql with custom template # Conflicts: # helm/api-platform/Chart.lock # helm/api-platform/Chart.yaml * chore: replace bitnami/keycloak with custom template * Initial plan * fix: replace bitnami/external-dns and fix Helm template issues Co-authored-by: vincentchalamon <407859+vincentchalamon@users.noreply.github.com> * fix: resolve Helm chart YAML parsing issues Co-authored-by: vincentchalamon <407859+vincentchalamon@users.noreply.github.com> * fix: correct PostgreSQL sidecar container probes and port protocol Co-authored-by: vincentchalamon <407859+vincentchalamon@users.noreply.github.com> * fix: fix deploy * fix: fix by @claude * fix: fix Keycloak deployment crash and E2E login selector - Add missing 'start' subcommand to Keycloak args (kc.sh requires it) - Replace CNPG PostgreSQL image with standalone postgres:16-alpine for sidecar - Fix E2E password selector for Keycloak 26.4 (getByRole instead of getByLabel) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: fix Keycloak startup crash on empty admin password and config mismatch - Guard KC_BOOTSTRAP_ADMIN_* env vars on non-empty adminPassword to prevent crash when keycloak-admin-password secret is not set in PR environments - Add --optimized flag to skip rebuild check on every start - Add build-time options to Dockerfile (--db, --http-relative-path, --health-enabled, --metrics-enabled) to match runtime config - Remove redundant build-time env vars from deployment template Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: copy provider JAR before kc.sh build to avoid --optimized startup failure Keycloak with --optimized checks that no provider JARs changed after the build. The JAR was copied after the build step, making its timestamp newer than the build artifacts and causing Keycloak to refuse startup. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: replace Bitnami KC_PRODUCTION with correct Keycloak HTTP/proxy env vars KC_PRODUCTION=true is a Bitnami-specific env var ignored by the official image. Keycloak start (production mode) requires TLS or http-enabled=true. Since TLS is terminated at the nginx ingress, enable HTTP and configure the proxy headers to trust X-Forwarded-* headers from the ingress. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: use httpRelativePath prefix for Keycloak health probes on management port The --http-relative-path build option also affects the management interface (port 9000). Health endpoints are at /<relative-path>/health/* not /health/*. Confirmed: /oidc/health/started returns 200, /health/started returns 404. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: enable nginx SSL redirect for HTTP→HTTPS 301 The k6 post-deploy check verifies that http:// redirects to https:// with a 301. ssl-redirect was set to false, preventing nginx from issuing the redirect. cert-manager provisions a valid TLS certificate on GKE so the redirect is safe. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: configure Claude Code * fix: update k6 check to accept nginx 308 redirect and location without trailing slash nginx-ingress uses 308 (not 301) for ssl-redirect to preserve HTTP method. The Location header for root path omits the trailing slash. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Vincent Chalamon <407859+vincentchalamon@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

@claude

* chore: replace bitnami/postgresql with custom template * chore: replace bitnami/keycloak with custom template * fix: replace Bitnami dependencies with official upstream charts (#593) * chore: replace bitnami/postgresql with custom template # Conflicts: # helm/api-platform/Chart.lock # helm/api-platform/Chart.yaml * chore: replace bitnami/keycloak with custom template * Initial plan * fix: replace bitnami/external-dns and fix Helm template issues Co-authored-by: vincentchalamon <407859+vincentchalamon@users.noreply.github.com> * fix: resolve Helm chart YAML parsing issues Co-authored-by: vincentchalamon <407859+vincentchalamon@users.noreply.github.com> * fix: correct PostgreSQL sidecar container probes and port protocol Co-authored-by: vincentchalamon <407859+vincentchalamon@users.noreply.github.com> * fix: fix deploy * fix: fix by @claude * fix: fix Keycloak deployment crash and E2E login selector - Add missing 'start' subcommand to Keycloak args (kc.sh requires it) - Replace CNPG PostgreSQL image with standalone postgres:16-alpine for sidecar - Fix E2E password selector for Keycloak 26.4 (getByRole instead of getByLabel) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: fix Keycloak startup crash on empty admin password and config mismatch - Guard KC_BOOTSTRAP_ADMIN_* env vars on non-empty adminPassword to prevent crash when keycloak-admin-password secret is not set in PR environments - Add --optimized flag to skip rebuild check on every start - Add build-time options to Dockerfile (--db, --http-relative-path, --health-enabled, --metrics-enabled) to match runtime config - Remove redundant build-time env vars from deployment template Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: copy provider JAR before kc.sh build to avoid --optimized startup failure Keycloak with --optimized checks that no provider JARs changed after the build. The JAR was copied after the build step, making its timestamp newer than the build artifacts and causing Keycloak to refuse startup. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: replace Bitnami KC_PRODUCTION with correct Keycloak HTTP/proxy env vars KC_PRODUCTION=true is a Bitnami-specific env var ignored by the official image. Keycloak start (production mode) requires TLS or http-enabled=true. Since TLS is terminated at the nginx ingress, enable HTTP and configure the proxy headers to trust X-Forwarded-* headers from the ingress. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: use httpRelativePath prefix for Keycloak health probes on management port The --http-relative-path build option also affects the management interface (port 9000). Health endpoints are at /<relative-path>/health/* not /health/*. Confirmed: /oidc/health/started returns 200, /health/started returns 404. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: enable nginx SSL redirect for HTTP→HTTPS 301 The k6 post-deploy check verifies that http:// redirects to https:// with a 301. ssl-redirect was set to false, preventing nginx from issuing the redirect. cert-manager provisions a valid TLS certificate on GKE so the redirect is safe. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: configure Claude Code * fix: update k6 check to accept nginx 308 redirect and location without trailing slash nginx-ingress uses 308 (not 301) for ssl-redirect to preserve HTTP method. The Location header for root path omits the trailing slash. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Vincent Chalamon <407859+vincentchalamon@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(helm): address PR review comments - Fix serverVersion in database-url secret: use 16 to match values.yaml - Remove KC_PRODUCTION from compose.prod.yaml (not a valid Keycloak env var) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(helm): remove obsolete Bitnami values Remove values.yaml keys that were consumed by bitnami/keycloak and bitnami/postgresql Helm charts but are never read by the custom templates: - postgresPassword (superuser password, unused by CloudNative PG and postgres sidecar) - keycloak.proxy (hardcoded as KC_PROXY_HEADERS in keycloak-deployment.yaml) - keycloak.tls (not wired in the custom template) - keycloak.startupProbe / readinessProbe / livenessProbe (hardcoded in template) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot AI assigned Copilot and vincentchalamon Feb 5, 2026

Copilot AI mentioned this pull request Feb 5, 2026

chore: replace bitnami dependencies #553

Merged

3 tasks

Copilot started work on behalf of vincentchalamon February 5, 2026 15:13 View session

This comment was marked as outdated.

Sign in to view

Copilot AI changed the title ~~[WIP] Fix invalid Helm chart and replace external DNS dependency~~ Replace bitnami Helm chart dependencies with upstream alternatives Feb 5, 2026

Copilot AI requested a review from vincentchalamon February 5, 2026 15:30

Copilot finished work on behalf of vincentchalamon February 5, 2026 15:30

vincentchalamon force-pushed the chore/bitnami branch from acd0b26 to b465368 Compare February 5, 2026 15:46

vincentchalamon force-pushed the copilot/sub-pr-553 branch from a7cbb87 to d98e96f Compare February 5, 2026 15:47

vincentchalamon added the deploy Deploys Pull Request label Feb 5, 2026

vincentchalamon had a problem deploying to pr-593 February 5, 2026 15:58 — with GitHub Actions Failure

vincentchalamon had a problem deploying to pr-593 February 9, 2026 08:29 — with GitHub Actions Failure

vincentchalamon had a problem deploying to pr-593 February 9, 2026 08:43 — with GitHub Actions Error

vincentchalamon had a problem deploying to pr-593 February 9, 2026 08:57 — with GitHub Actions Failure

slim suggested changes Feb 17, 2026

View reviewed changes

helm/api-platform/templates/external-dns-deployment.yaml Outdated Show resolved Hide resolved

Copilot started work on behalf of vincentchalamon February 17, 2026 13:58 View session

Copilot finished work on behalf of vincentchalamon February 17, 2026 14:00

vincentchalamon force-pushed the chore/bitnami branch from b465368 to 1c26425 Compare March 16, 2026 08:06

vincentchalamon and others added 7 commits March 16, 2026 09:07

chore: replace bitnami/postgresql with custom template

89a03b6

# Conflicts: # helm/api-platform/Chart.lock # helm/api-platform/Chart.yaml

chore: replace bitnami/keycloak with custom template

157540b

Initial plan

4d88a84

fix: replace bitnami/external-dns and fix Helm template issues

264fa50

Co-authored-by: vincentchalamon <407859+vincentchalamon@users.noreply.github.com>

fix: resolve Helm chart YAML parsing issues

7846570

Co-authored-by: vincentchalamon <407859+vincentchalamon@users.noreply.github.com>

fix: correct PostgreSQL sidecar container probes and port protocol

9a8f8a1

Co-authored-by: vincentchalamon <407859+vincentchalamon@users.noreply.github.com>

fix: fix deploy

7bef2ef

vincentchalamon force-pushed the copilot/sub-pr-553 branch from de40a44 to 7bef2ef Compare March 16, 2026 08:08

fix: fix by @claude

836bf23

vincentchalamon had a problem deploying to pr-593 March 16, 2026 09:17 — with GitHub Actions Failure

vincentchalamon changed the title ~~Replace bitnami Helm chart dependencies with upstream alternatives~~ fix: replace Bitnami dependencies with official upstream charts Mar 16, 2026

vincentchalamon had a problem deploying to pr-593 March 16, 2026 09:51 — with GitHub Actions Failure

vincentchalamon had a problem deploying to pr-593 March 16, 2026 11:25 — with GitHub Actions Failure

vincentchalamon had a problem deploying to pr-593 March 16, 2026 11:53 — with GitHub Actions Failure

vincentchalamon had a problem deploying to pr-593 March 16, 2026 12:06 — with GitHub Actions Failure

vincentchalamon temporarily deployed to pr-593 March 16, 2026 12:28 — with GitHub Actions Inactive

vincentchalamon temporarily deployed to pr-593 March 16, 2026 12:44 — with GitHub Actions Inactive

vincentchalamon and others added 2 commits March 16, 2026 13:57

chore: configure Claude Code

39632a1

fix: update k6 check to accept nginx 308 redirect and location withou…

3acb27c

…t trailing slash nginx-ingress uses 308 (not 301) for ssl-redirect to preserve HTTP method. The Location header for root path omits the trailing slash. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

vincentchalamon deployed to pr-593 March 16, 2026 13:07 — with GitHub Actions View deployment

vincentchalamon marked this pull request as ready for review March 16, 2026 13:18

vincentchalamon merged commit 223d4ce into chore/bitnami Mar 16, 2026
7 checks passed

vincentchalamon deleted the copilot/sub-pr-553 branch March 16, 2026 13:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: replace Bitnami dependencies with official upstream charts#593

fix: replace Bitnami dependencies with official upstream charts#593
vincentchalamon merged 16 commits intochore/bitnamifrom
copilot/sub-pr-553

Copilot AI commented Feb 5, 2026 •

edited by vincentchalamon

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Feb 5, 2026 • edited by vincentchalamon Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❓ Why

📝 Changes

external-dns: custom template → official chart

Keycloak deployment: 5 bug fixes

ConfigMap fix

Chart version

⚠️ Important: Keycloak replicas

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Feb 5, 2026 •

edited by vincentchalamon

Loading