update chart dependencies

[monotek]

What this PR does / why we need it

• remove executable bit from some files

• update chart dependencies

  • use bitnami oci chart repo
  • replaces bitnamilegacy with bitnamicsecure where possible
    • as only latest tag is available for bitnamisecure images the sha digest is used to fix it to a specific version

• todo (because not bitnamisecure image available):

  • use official elasticsearch chart: https://github.com/elastic/cloud-on-k8s/tree/main/deploy/eck-stack/charts/eck-elasticsearch
  • use official minio chart: https://github.com/minio/minio/tree/master/helm/minio

Which issue this PR fixes

(optional, in fixes #<issue number>(, fixes #<issue_number>, …) format, will close that issue when PR gets merged)

• Bitnami discontinues mostly all free public versioned images with impact for helm-charts #353
• redis cve-2025-49844 Critical CVSS 10. #367

Special notes for your reviewer

• work in progress

Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

• Chart Version bumped
• Upgrading instructions are documented in the zammad/README.md

[mgruner]

Interesting idea. Do you really think this would be a sustainable solution? How would we be able to patch dependencies while avoiding major updates like for PostgreSQL in this PR?

[monotek]

You mean because you can't see the actual version in the image tag / SHA digest?
That's the reason for the version comment above, which you have to add whenever you update the image.
I retrieved the versions from the containers via CLI because I was unsure if the https://github.com/bitnami/containers repository is still the source of the Dockerfile.

Yes, that's a bit more work, but likely still easier than finding a new PostgreSQL Docker image and a fitting Helm chart we can use.

[mgruner]

How did you extract this info via cli?

[monotek]

"psql -V" for example.
Unfortunately, PostgreSQL only shows the major version, so i need to find a better way.
redis & memcached binaries are more explicit.

[greedybro]

@monotek I looked a bit at the versions of postgreSQL and it seems that starting with the 10.x release, there is no patch versions anymore. You can see all versions published here

So the returning version of psql -V is accurate. You can also use SELECT version(); in a psql cli to check

[greedybro]

i'm also curious about the format of latest@sha256:0eeb6604ad4258924850a38dfcd56697351086ede82e9c7668451c50569548b2

why use latest@ ? docker pull returns an invalid reference format when using it

[mgruner]

What about using cloudpirates https://artifacthub.io/packages/search?org=cloudpirates&sort=relevance&page=1 for any charts where no official chart exists yet? They seem to have redis, memcached and postgresql now. 🤷 Or is there any other alternative?

For now, it might be enough to simply switch redis and not touch the others.

[monotek]

It depends how much work you want to invest.
As far as i know the cloudpirates charts are no forks of the bitnami ones so there is likely no easy update path.