apps sc: upgrade thanos to 17.3.1

Now uses thanos image from quay

Holding at 0.39.2 until upstream memory/cpu issue is resolved

bin: Fix resolution of repo root in sbom scripts

Seems if you call scripts as `sbom/generate.sh`, two paths are output by `cd && pwd`, which then breaks later uses of
the `$REPO_ROOT` variable.

Author: Zash

helmfile.d/lists/images.yaml

@@ -95,7 +95,7 @@ images:
   tekton:
     controller: ghcr.io/tektoncd/pipeline/controller-10a3e32792f33651396d02b6855a6e36:v1.1.0@sha256:72ba947187317aee83b8b6ba510b17375bede4ce062e366cd0162515e0f7d5f2
   thanos:
-    image: ghcr.io/elastisys/bitnami/thanos:0.37.2-debian-12-r8
+    image: quay.io/thanos/thanos:v0.39.2
   velero:
     image: docker.io/velero/velero:v1.16.1
     pluginAws: docker.io/velero/velero-plugin-for-aws:v1.9.0

helmfile.d/upstream/bitnami/thanos/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: minio
   repository: oci://registry-1.docker.io/bitnamicharts
-  version: 15.0.5
+  version: 17.0.19
 - name: common
   repository: oci://registry-1.docker.io/bitnamicharts
-  version: 2.30.0
-digest: sha256:c21010fcd391c9564b494e001720005981d7e2ef81aa9ea473e18b7a9324567d
-generated: "2025-03-05T05:09:56.729039288Z"
+  version: 2.31.4
+digest: sha256:294dcecc3125f591a6e2158d207ce3418746bbd0cccf057d477f47788929255b
+generated: "2025-08-13T18:18:49.570029863Z"

helmfile.d/upstream/bitnami/thanos/Chart.yaml

@@ -2,17 +2,18 @@ annotations:
   category: Analytics
   images: |
     - name: os-shell
-      image: docker.io/bitnami/os-shell:12-debian-12-r39
+      image: docker.io/bitnami/os-shell:12-debian-12-r50
     - name: thanos
-      image: docker.io/bitnami/thanos:0.37.2-debian-12-r8
+      image: docker.io/bitnami/thanos:0.39.2-debian-12-r2
   licenses: Apache-2.0
+  tanzuCategory: application
 apiVersion: v2
-appVersion: 0.37.2
+appVersion: 0.39.2
 dependencies:
 - condition: minio.enabled
   name: minio
   repository: oci://registry-1.docker.io/bitnamicharts
-  version: 15.x.x
+  version: 17.x.x
 - name: common
   repository: oci://registry-1.docker.io/bitnamicharts
   tags:
@@ -34,4 +35,4 @@ maintainers:
 name: thanos
 sources:
 - https://github.com/bitnami/charts/tree/main/bitnami/thanos
-version: 15.13.1
+version: 17.3.1

helmfile.d/upstream/bitnami/thanos/README.md

@@ -2,7 +2,7 @@ annotations:
   category: Infrastructure
   licenses: Apache-2.0
 apiVersion: v2
-appVersion: 2.30.0
+appVersion: 2.31.4
 description: A Library Helm Chart for grouping common logic between bitnami charts.
   This chart is not deployable by itself.
 home: https://bitnami.com
@@ -20,4 +20,4 @@ name: common
 sources:
 - https://github.com/bitnami/charts/tree/main/bitnami/common
 type: library
-version: 2.30.0
+version: 2.31.4

helmfile.d/upstream/bitnami/thanos/charts/common/Chart.yaml

@@ -82,7 +82,7 @@ preferredDuringSchedulingIgnoredDuringExecution:
       namespaces:
         - {{ .context.Release.Namespace }}
         {{- with $extraNamespaces }}
-        {{ include "common.tplvalues.render" (dict "value" . "context" $) | nindent 8 }}
+        {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 8 }}
         {{- end }}
       {{- end }}
       topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
@@ -97,6 +97,13 @@ preferredDuringSchedulingIgnoredDuringExecution:
           {{- range $key, $value := .extraMatchLabels }}
           {{ $key }}: {{ $value | quote }}
           {{- end }}
+      {{- if .namespaces }}
+      namespaces:
+        - {{ $.context.Release.Namespace }}
+        {{- with .namespaces }}
+        {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 8 }}
+        {{- end }}
+      {{- end }}
       topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
     weight: {{ .weight | default 1 -}}
   {{- end -}}
@@ -121,13 +128,13 @@ requiredDuringSchedulingIgnoredDuringExecution:
         {{- range $key, $value := $extraMatchLabels }}
         {{ $key }}: {{ $value | quote }}
         {{- end }}
-      {{- if $extraNamespaces }}
-      namespaces:
-        - {{ .context.Release.Namespace }}
-        {{- with $extraNamespaces }}
-        {{ include "common.tplvalues.render" (dict "value" . "context" $) | nindent 8 }}
-        {{- end }}
+    {{- if $extraNamespaces }}
+    namespaces:
+      - {{ .context.Release.Namespace }}
+      {{- with $extraNamespaces }}
+      {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 6 }}
       {{- end }}
+    {{- end }}
     topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
   {{- range $extraPodAffinityTerms }}
   - labelSelector:
@@ -138,6 +145,13 @@ requiredDuringSchedulingIgnoredDuringExecution:
         {{- range $key, $value := .extraMatchLabels }}
         {{ $key }}: {{ $value | quote }}
         {{- end }}
+    {{- if .namespaces }}
+    namespaces:
+      - {{ $.context.Release.Namespace }}
+      {{- with .namespaces }}
+      {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 6 }}
+      {{- end }}
+    {{- end }}
     topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
   {{- end -}}
 {{- end -}}

helmfile.d/upstream/bitnami/thanos/charts/common/README.md

@@ -30,162 +30,93 @@ Usage:
 Return the appropriate apiVersion for poddisruptionbudget.
 */}}
 {{- define "common.capabilities.policy.apiVersion" -}}
-{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
-{{- if and (not (empty $kubeVersion)) (semverCompare "<1.21-0" $kubeVersion) -}}
-{{- print "policy/v1beta1" -}}
-{{- else -}}
 {{- print "policy/v1" -}}
 {{- end -}}
-{{- end -}}
 
 {{/*
 Return the appropriate apiVersion for networkpolicy.
 */}}
 {{- define "common.capabilities.networkPolicy.apiVersion" -}}
-{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
-{{- if and (not (empty $kubeVersion)) (semverCompare "<1.7-0" $kubeVersion) -}}
-{{- print "extensions/v1beta1" -}}
-{{- else -}}
 {{- print "networking.k8s.io/v1" -}}
 {{- end -}}
-{{- end -}}
 
 {{/*
 Return the appropriate apiVersion for job.
 */}}
 {{- define "common.capabilities.job.apiVersion" -}}
-{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
-{{- if and (not (empty $kubeVersion)) (semverCompare "<1.21-0" $kubeVersion) -}}
-{{- print "batch/v1beta1" -}}
-{{- else -}}
 {{- print "batch/v1" -}}
 {{- end -}}
-{{- end -}}
 
 {{/*
 Return the appropriate apiVersion for cronjob.
 */}}
 {{- define "common.capabilities.cronjob.apiVersion" -}}
-{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
-{{- if and (not (empty $kubeVersion)) (semverCompare "<1.21-0" $kubeVersion) -}}
-{{- print "batch/v1beta1" -}}
-{{- else -}}
 {{- print "batch/v1" -}}
 {{- end -}}
-{{- end -}}
 
 {{/*
 Return the appropriate apiVersion for daemonset.
 */}}
 {{- define "common.capabilities.daemonset.apiVersion" -}}
-{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
-{{- if and (not (empty $kubeVersion)) (semverCompare "<1.14-0" $kubeVersion) -}}
-{{- print "extensions/v1beta1" -}}
-{{- else -}}
 {{- print "apps/v1" -}}
 {{- end -}}
-{{- end -}}
 
 {{/*
 Return the appropriate apiVersion for deployment.
 */}}
 {{- define "common.capabilities.deployment.apiVersion" -}}
-{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
-{{- if and (not (empty $kubeVersion)) (semverCompare "<1.14-0" $kubeVersion) -}}
-{{- print "extensions/v1beta1" -}}
-{{- else -}}
 {{- print "apps/v1" -}}
 {{- end -}}
-{{- end -}}
 
 {{/*
 Return the appropriate apiVersion for statefulset.
 */}}
 {{- define "common.capabilities.statefulset.apiVersion" -}}
-{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
-{{- if and (not (empty $kubeVersion)) (semverCompare "<1.14-0" $kubeVersion) -}}
-{{- print "apps/v1beta1" -}}
-{{- else -}}
 {{- print "apps/v1" -}}
 {{- end -}}
-{{- end -}}
 
 {{/*
 Return the appropriate apiVersion for ingress.
 */}}
 {{- define "common.capabilities.ingress.apiVersion" -}}
-{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
-{{- if (.Values.ingress).apiVersion -}}
-{{- .Values.ingress.apiVersion -}}
-{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.14-0" $kubeVersion) -}}
-{{- print "extensions/v1beta1" -}}
-{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.19-0" $kubeVersion) -}}
-{{- print "networking.k8s.io/v1beta1" -}}
-{{- else -}}
 {{- print "networking.k8s.io/v1" -}}
-{{- end }}
 {{- end -}}
 
 {{/*
 Return the appropriate apiVersion for RBAC resources.
 */}}
 {{- define "common.capabilities.rbac.apiVersion" -}}
-{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
-{{- if and (not (empty $kubeVersion)) (semverCompare "<1.17-0" $kubeVersion) -}}
-{{- print "rbac.authorization.k8s.io/v1beta1" -}}
-{{- else -}}
 {{- print "rbac.authorization.k8s.io/v1" -}}
 {{- end -}}
-{{- end -}}
 
 {{/*
 Return the appropriate apiVersion for CRDs.
 */}}
 {{- define "common.capabilities.crd.apiVersion" -}}
-{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
-{{- if and (not (empty $kubeVersion)) (semverCompare "<1.19-0" $kubeVersion) -}}
-{{- print "apiextensions.k8s.io/v1beta1" -}}
-{{- else -}}
 {{- print "apiextensions.k8s.io/v1" -}}
 {{- end -}}
-{{- end -}}
 
 {{/*
 Return the appropriate apiVersion for APIService.
 */}}
 {{- define "common.capabilities.apiService.apiVersion" -}}
-{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
-{{- if and (not (empty $kubeVersion)) (semverCompare "<1.10-0" $kubeVersion) -}}
-{{- print "apiregistration.k8s.io/v1beta1" -}}
-{{- else -}}
 {{- print "apiregistration.k8s.io/v1" -}}
 {{- end -}}
-{{- end -}}
 
 {{/*
 Return the appropriate apiVersion for Horizontal Pod Autoscaler.
 */}}
 {{- define "common.capabilities.hpa.apiVersion" -}}
 {{- $kubeVersion := include "common.capabilities.kubeVersion" .context -}}
-{{- if and (not (empty $kubeVersion)) (semverCompare "<1.23-0" $kubeVersion) -}}
-{{- if .beta2 -}}
-{{- print "autoscaling/v2beta2" -}}
-{{- else -}}
-{{- print "autoscaling/v2beta1" -}}
-{{- end -}}
-{{- else -}}
 {{- print "autoscaling/v2" -}}
 {{- end -}}
-{{- end -}}
 
 {{/*
 Return the appropriate apiVersion for Vertical Pod Autoscaler.
 */}}
 {{- define "common.capabilities.vpa.apiVersion" -}}
-{{- $kubeVersion := include "common.capabilities.kubeVersion" .context -}}
-{{- if and (not (empty $kubeVersion)) (semverCompare "<1.11-0" $kubeVersion) -}}
-{{- print "autoscaling/v1beta1" -}}
-{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.25-0" $kubeVersion) -}}
+{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
+{{- if and (not (empty $kubeVersion)) (semverCompare "<1.25-0" $kubeVersion) -}}
 {{- print "autoscaling/v1beta2" -}}
 {{- else -}}
 {{- print "autoscaling/v1" -}}
@@ -207,19 +138,15 @@ Returns true if AdmissionConfiguration is supported
 */}}
 {{- define "common.capabilities.admissionConfiguration.supported" -}}
 {{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
-{{- if or (empty $kubeVersion) (not (semverCompare "<1.23-0" $kubeVersion)) -}}
   {{- true -}}
 {{- end -}}
-{{- end -}}
 
 {{/*
 Return the appropriate apiVersion for AdmissionConfiguration.
 */}}
 {{- define "common.capabilities.admissionConfiguration.apiVersion" -}}
 {{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
-{{- if and (not (empty $kubeVersion)) (semverCompare "<1.23-0" $kubeVersion) -}}
-{{- print "apiserver.config.k8s.io/v1alpha1" -}}
-{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.25-0" $kubeVersion) -}}
+{{- if and (not (empty $kubeVersion)) (semverCompare "<1.25-0" $kubeVersion) -}}
 {{- print "apiserver.config.k8s.io/v1beta1" -}}
 {{- else -}}
 {{- print "apiserver.config.k8s.io/v1" -}}
@@ -231,9 +158,7 @@ Return the appropriate apiVersion for PodSecurityConfiguration.
 */}}
 {{- define "common.capabilities.podSecurityConfiguration.apiVersion" -}}
 {{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
-{{- if and (not (empty $kubeVersion)) (semverCompare "<1.23-0" $kubeVersion) -}}
-{{- print "pod-security.admission.config.k8s.io/v1alpha1" -}}
-{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.25-0" $kubeVersion) -}}
+{{- if and (not (empty $kubeVersion)) (semverCompare "<1.25-0" $kubeVersion) -}}
 {{- print "pod-security.admission.config.k8s.io/v1beta1" -}}
 {{- else -}}
 {{- print "pod-security.admission.config.k8s.io/v1" -}}

helmfile.d/upstream/bitnami/thanos/charts/common/templates/_affinities.tpl

@@ -38,6 +38,7 @@ Usage:
 {{- define "common.errors.insecureImages" -}}
 {{- $relocatedImages := list -}}
 {{- $replacedImages := list -}}
+{{- $bitnamiLegacyImages := list -}}
 {{- $retaggedImages := list -}}
 {{- $globalRegistry := ((.context.Values.global).imageRegistry) -}}
 {{- $originalImages := .context.Chart.Annotations.images -}}
@@ -49,7 +50,10 @@ Usage:
     {{- if not (contains $registryName $originalImages) -}}
       {{- $relocatedImages = append $relocatedImages $fullImageName  -}}
     {{- else if not (contains .repository $originalImages) -}}
-      {{- $replacedImages = append $replacedImages $fullImageName  -}}
+      {{- $replacedImages = append $replacedImages $fullImageName -}}
+      {{- if contains "docker.io/bitnamilegacy/" $fullImageNameNoTag -}}
+        {{- $bitnamiLegacyImages = append $bitnamiLegacyImages $fullImageName -}}
+      {{- end -}}
     {{- end -}}
   {{- end -}}
   {{- if not (contains (printf "%s:%s" .repository .tag) $originalImages) -}}
@@ -58,14 +62,17 @@ Usage:
 {{- end -}}
 
 {{- if and (or (gt (len $relocatedImages) 0) (gt (len $replacedImages) 0)) (((.context.Values.global).security).allowInsecureImages) -}}
-  {{- print "\n\n⚠ SECURITY WARNING: Verifying original container images was skipped. Please note this Helm chart was designed, tested, and validated on multiple platforms using a specific set of Bitnami and Tanzu Application Catalog containers. Substituting other containers is likely to cause degraded security and performance, broken chart features, and missing environment variables.\n" -}}
+  {{- print "\n\n⚠ SECURITY WARNING: Verifying original container images was skipped. Please note this Helm chart was designed, tested, and validated on multiple platforms using a specific set of Bitnami and Bitnami Secure Images containers. Substituting other containers is likely to cause degraded security and performance, broken chart features, and missing environment variables.\n" -}}
 {{- else if (or (gt (len $relocatedImages) 0) (gt (len $replacedImages) 0)) -}}
   {{- $errorString := "Original containers have been substituted for unrecognized ones. Deploying this chart with non-standard containers is likely to cause degraded security and performance, broken chart features, and missing environment variables." -}}
   {{- $errorString = print $errorString "\n\nUnrecognized images:" -}}
   {{- range (concat $relocatedImages $replacedImages) -}}
     {{- $errorString = print $errorString "\n  - " . -}}
   {{- end -}}
-  {{- if or (contains "docker.io/bitnami/" $originalImages) (contains "docker.io/bitnamiprem/" $originalImages) -}}
+  {{- if and (eq (len $relocatedImages) 0) (eq (len $replacedImages) (len $bitnamiLegacyImages)) -}}
+    {{- $errorString = print "\n\n⚠ WARNING: " $errorString -}}
+    {{- print $errorString -}}
+  {{- else if or (contains "docker.io/bitnami/" $originalImages) (contains "docker.io/bitnamiprem/" $originalImages) (contains "docker.io/bitnamisecure/" $originalImages) -}}
     {{- $errorString = print "\n\n⚠ ERROR: " $errorString -}}
     {{- $errorString = print $errorString "\n\nIf you are sure you want to proceed with non-standard containers, you can skip container image verification by setting the global parameter 'global.security.allowInsecureImages' to true." -}}
     {{- $errorString = print $errorString "\nFurther information can be obtained at https://github.com/bitnami/charts/issues/30850" -}}
@@ -75,11 +82,11 @@ Usage:
     {{- print $errorString -}}
   {{- end -}}
 {{- else if gt (len $retaggedImages) 0 -}}
-  {{- $warnString := "\n\n⚠ WARNING: Original containers have been retagged. Please note this Helm chart was tested, and validated on multiple platforms using a specific set of Tanzu Application Catalog containers. Substituting original image tags could cause unexpected behavior." -}}
+  {{- $warnString := "\n\n⚠ WARNING: Original containers have been retagged. Please note this Helm chart was tested, and validated on multiple platforms using a specific set of Bitnami and Bitnami Secure Images containers. Substituting original image tags could cause unexpected behavior." -}}
   {{- $warnString = print $warnString "\n\nRetagged images:" -}}
   {{- range $retaggedImages -}}
     {{- $warnString = print $warnString "\n  - " . -}}
   {{- end -}}
   {{- print $warnString -}}
 {{- end -}}
-{{- end -}}
+{{- end -}}