feat: switch to DHI images for clickhouse, zookeeper, valkey, postgres

[jpaodev]

Describe the feature

• I propose switching to DHI (Docker Hardened Images) version of the images used in the chart
• I should be able to provide updated chart for clickhouse, valkey, zookeeper. I have edited the Chart.yaml and the chart itself to achieve this in a backwards-compatible way. (see below)
• I am running valkey DHI image (should be full drop-in replacement)
• I am running clickhouse, zookeeper DHI images (was a pain to replace, removed the original charts and added own resources e.g. clickhouse-secret.yaml nextauth-secret.yaml zookeeper-pdb.yaml clickhouse-service.yaml postgresql-secret.yaml zookeeper-service.yaml

Important: Imo it would be much cleaner using the DHI helm charts as dependencies instead of addign own resources (e.g. clickhouse-statefulset.yaml and similar), however I did it this way to have full compatibility with data from previous PVCs (Persistent Volume Claims).

Existing DHI images:

• valkey: dhi.io/valkey:8.1.15-debian13 (Tested, should be drop-in)
• clickhouse: dhi.io/clickhouse-server:25.12.2-debian13 (Tested, not drop-in)
• zookeeper: dhi.io/zookeeper:3.9.4-jre23-debian13 (Tested, not drop-in)
• minio: NONE FOUND (!)
• postgresql: https://hub.docker.com/hardened-images/catalog/dhi/postgres - IMPORTANT: NOT TESTED (!) - Reason: I didn't get it to work and didn't bother here yet, but might still update. For prod I recommend using a managed SQL database or something like CloudNativePG I suppose would be more suitable.

apiVersion: v2
name: langfuse
version: 1.5.14
description: Open source LLM engineering platform - LLM observability, metrics, evaluations, prompt management.
type: application
keywords:
  - langfuse
  - llm
  - observability
  - prompt management
  - metrics
home: https://langfuse.com/
sources:
  - https://github.com/langfuse/langfuse
  - https://github.com/langfuse/langfuse-k8s
dependencies:
  - name: postgresql
    version: 16.4.9
    repository: oci://registry-1.docker.io/bitnamicharts
    condition: postgresql.deploy
  - name: valkey
    version: 2.2.4
    repository: oci://registry-1.docker.io/bitnamicharts
    condition: redis.deploy
    alias: redis
  - name: minio
    version: 14.10.5
    repository: oci://registry-1.docker.io/bitnamicharts
    condition: s3.deploy
    alias: s3
  - name: common
    version: 2.30.0
    repository: oci://registry-1.docker.io/bitnamicharts
maintainers:
  - name: langfuse
    email: contact@langfuse.com
    url: https://langfuse.com/
icon: https://langfuse.com/langfuse_logo.png
appVersion: "3.137.0"

Use cases

• Should fix LFE-7883 pretty much completely
• Massively increases security by using minimal / hardened images

Additional information

No response

Are you interested to contribute this feature?

Yes

[jpaodev]

Addition: I apologize, it seems like Valkey is not a drop-in replacement with the DHI image as I would've intially expected - if running with replicas, it fails with an error (basically sed is missing and used by the bitnami chart). It seems like I was able to fix this by overriding the startup script in the langfuse values.yaml and synchronization with the replica seems to work now.

Vallkey Sentinel sadly would not be fully supported in such a setup, since sadly there is no DHI image available for that.

[z0rc]

I think DHI aren't a complete solution. Bitnami charts are also problematic due stopped maintenance and uncertian availability long-term.

Lastly with up-to-date clickhouse there is no need to run zookeeper, which is one less dependency to care about.

[jpaodev]

I think DHI aren't a complete solution. Bitnami charts are also problematic due stopped maintenance and uncertian availability long-term.

Lastly with up-to-date clickhouse there is no need to run zookeeper, which is one less dependency to care about.

Hi there! Thanks for the response!

Bitnami charts are also problematic due stopped maintenance and uncertian availability long-term.
Fully agree there, ideally the chart would be fully switched to non-bitnami. Maybe it would make sense to create a full new repository then with non-bitnami charts (maybe DHI charts?)

Overall I think DHI is quite nice and would use it whereever possible. From what I saw for example the official valkey chart does sadly not support sentinel mode, bitnami chart does however. But overall once these features are added I think that might be a viable option for a switchover (using official charts). For PostgreSQL I guess bitnami as-is now is also fine, considering that this is most likely only relevant for testing in this setup.

Lastly with up-to-date clickhouse there is no need to run zookeeper, which is one less dependency to care about.

You would replace this with keeper, right?

[Steffen911]

Hey all,
Thank you for the suggestions and the experimentation! As part of #206 we need to investigate if we release a breaking v2 release of this chart with new sub-charts and hardened images or if we try to perform the migration in-place with updates to existing charts.
We'll keep this open as a reference, but most work will probably happen in the main image. We're very open for contributions or suggestions from the community on this!

[jpaodev]

Hey all, Thank you for the suggestions and the experimentation! As part of #206 we need to investigate if we release a breaking v2 release of this chart with new sub-charts and hardened images or if we try to perform the migration in-place with updates to existing charts. We'll keep this open as a reference, but most work will probably happen in the main image. We're very open for contributions or suggestions from the community on this!

Sir this is no experimentation, I'm going to prod with this 😎

[Breee]

chainguard images for minio? https://images.chainguard.dev/directory/image/minio/overview

else there are other s3 compatible tools, e.g. https://github.com/rustfs/rustfs - as minio stopped building images anyway

[vkryzh]

@Breee garagehq as a replacement for the minio?

[jpaodev]

@Steffen911 hey there Steffen. I'm very happy with the deployment and it's running smoothly in production for a decent amount of use. All of the images I use are official DHI images, only for valkey-sentinel I have built my own image. If you are interested, please let me know! :-)

[Steffen911]

@jpaodev Do you have a public fork that you can share or a private repo you could invite me to? Would be curious about the diff to the current state and potentially bringing this upstream!

[jpaodev]

Hey there @Steffen911 , apologies for the late response! https://github.com/jpaodev/langfuse-k8s/tree/feat-dhi-draft created this, note that I also use valkey sentinel personally, but had to create a custom image for that, sadly no DHI image available yet. In general my goal was to basically have everything as backwards-compatible as possible.
Thanks for the cool tool and would be happy to make this more secure for everyone! :)