[bitnami/keycloak] fix default image repositories to bitnamilegacy for pullable tags

[LordRobinCbz]

Description of the change

Updates default container image repositories in the Keycloak chart from docker.io/bitnami/* to docker.io/bitnamilegacy/* for Keycloak, keycloak-config-cli, and the bundled PostgreSQL subchart.

Since the Bitnami catalog migration (#35164), versioned tags referenced by chart 25.2.0 return 404 on Docker Hub:

• docker.io/bitnami/keycloak:26.3.3-debian-12-r0
• docker.io/bitnami/postgresql:17.6.0-debian-12-r0
• docker.io/bitnami/keycloak-config-cli:6.4.0-debian-12-r11

Equivalent tags exist under docker.io/bitnamilegacy/*.

This PR includes four files:

File	Change
bitnami/keycloak/Chart.yaml	Bump version 25.2.0 → 25.2.1; update annotations.images
bitnami/keycloak/values.yaml	Update image repositories; add postgresql.image block with @param metadata; set allowInsecureImages: true
bitnami/keycloak/README.md	Regenerated via readme-generator-for-helm
(commits)	DCO sign-off on all commits

Benefits

• Default helm install / helm upgrade works without manual --set image.repository=bitnamilegacy/... overrides.
• Bundled PostgreSQL subchart receives a pullable image via parent postgresql.image.* values.
• Aligns chart defaults with the legacy migration workaround documented in Upcoming changes to the Bitnami catalog (effective August 28th, 2025) #35164 FAQ.

Possible drawbacks

• bitnamilegacy/* images are archived and receive no further updates or security patches (same limitation as the documented FAQ workaround).
• global.security.allowInsecureImages: true disables built-in image repository verification for non-bitnami/* paths.
• Users explicitly overriding image.repository back to bitnami/* are unaffected.
• Previously published OCI chart revisions at registry-1.docker.io/bitnamicharts are not retroactively updated; consumers must use a new chart revision after merge/publication.

Applicable issues

• Related to Upcoming changes to the Bitnami catalog (effective August 28th, 2025) #35164
• Related to bitnami legacy charts #36215

Additional information

Reproduction (before fix)

helm install keycloak oci://registry-1.docker.io/bitnamicharts/keycloak --version 25.2.0

Observed kubelet error:

Failed to pull image "docker.io/bitnami/postgresql:17.6.0-debian-12-r0": not found
Failed to pull image "docker.io/bitnami/keycloak:26.3.3-debian-12-r0": not found

Docker Hub tag check (2026-06-24)

Image	Tag	bitnami/*	bitnamilegacy/*
keycloak	26.3.3-debian-12-r0	404	200
postgresql	17.6.0-debian-12-r0	404	200
keycloak-config-cli	6.4.0-debian-12-r11	404	200

Validation (after fix)

docker pull docker.io/bitnamilegacy/keycloak:26.3.3-debian-12-r0
docker pull docker.io/bitnamilegacy/postgresql:17.6.0-debian-12-r0
docker pull docker.io/bitnamilegacy/keycloak-config-cli:6.4.0-debian-12-r11

helm template test bitnami/keycloak \
  --values bitnami/keycloak/values.yaml \
  | grep -E 'image:.*(bitnami|bitnamilegacy)'

Regenerate README (required before opening PR)

readme-generator \
  --values bitnami/keycloak/values.yaml \
  --readme bitnami/keycloak/README.md

Install tool: https://github.com/bitnami/readme-generator-for-helm

Commit message (with DCO)

[bitnami/keycloak] fix default image repositories to bitnamilegacy for pullable tags

Signed-off-by: Your Name <your.email@example.com>

Checklist

• Chart version bumped in Chart.yaml according to semver. This is not necessary when the changes only affect README.md files.
• Variables are documented in the values.yaml and added to the README.md using readme-generator-for-helm
• Title of the pull request follows this pattern [bitnami/<name_of_the_chart>] Descriptive title
• All commits signed off and in agreement of Developer Certificate of Origin (DCO)

[LordRobinCbz]

Hello @javsalgar ,

First of all, I am sorry to tell you that I didn't ran correctly the readme-generator-for-helm (need specific version of NodeJs, CLI tool only avaialble on UNIX, custom Windows installation that I have doesn't allow me to do it correctly).

I guess some files need to be edited to (chart.lock ?) But I am not sure, can you tell me ?

This PR is not mandatory for my current works, because I can override used images, so take your time :)

Many thanks

[carrodher]

Thank you for the contribution and for the detailed description!

We appreciate you taking the time to investigate this and put together a fix. However, we won't be changing the default image repositories to bitnamilegacy/* in the chart defaults.

The reason is that bitnamilegacy/* images are archived and receive no further updates or security patches, so we don't want to silently point new installations at unmaintained images by default. It is intentional that the chart's defaults reflect the current, actively maintained catalog location.

If you need to use the legacy images (e.g. to keep an existing deployment running on older tags), you can override the repository at install/upgrade time. We understand this is inconvenient, but keeping these overrides explicit ensures users are aware they are opting into archived images.

[LordRobinCbz]

Hello @carrodher

No problem, I understand your reasoning.

That said, because of the issue described in my report, the current Keycloak Helm chart cannot be deployed successfully without several manual overrides.

From my understanding, the current approach means keeping a chart that does not work out of the box rather than relying on the legacy images. I understand the concerns regarding archived and unmaintained images, and I agree that they should not become the default for new installations.

However, would it be possible to publish the missing tags on Docker Hub (or provide another compatible solution) so that the chart can function correctly without requiring users to rewrite multiple image definitions?

From a user's perspective, someone trying to deploy the chart will immediately run into this issue. This may lead them to conclude that the chart is broken and potentially choose an alternative solution instead. That's why I'm wondering whether leaving the chart in a non-functional state is preferable to providing a fix that restores a working out-of-the-box experience.

[carrodher]

Hi @LordRobinCbz, those are fair points and we appreciate the thoughtful follow-up.

You are right that the chart does not work out of the box without manual overrides, and we understand that this creates a poor first-time experience. However, publishing new versioned tags to docker.io/bitnami or restoring missing ones is not something we are able to do since the public catalog changes described in #35164 are not reversible.

The supported path for a fully functional, out-of-the-box Helm chart experience is a Bitnami Secure Images (BSI) subscription. BSI provides:

• Continuously updated and verified Helm charts and container images
• Versioned tags with ongoing security patches and rebuilds
• No manual image overrides required

For users who need a temporary workaround without a subscription, the manual --set overrides pointing to bitnamilegacy/* (as documented in #35164) remain the only free option, with the understanding that those images are archived and will not receive further updates.