Skip to content

Thanos Helm Chart

A community-maintained build of the Thanos Helm chart, hosted in the ALASCA GitLab and published as alasca-thanos. It is rebuilt from the upstream Bitnami Thanos chart sources but wired to upstream, Apache 2.0 container images, so it replaces the Bitnami chart that is no longer freely usable. It is the shared, lasting solution for ALASCA projects and others that depend on Thanos for long-term metrics storage.
Source project alasca.cloud/cai/charts/thanos
Published chart alasca-thanos via https://charts.alasca.cloud/thanos
License Apache 2.0
Built from Bitnami Thanos chart (Apache 2.0)
Images used docker.io/thanosio/thanos, docker.io/bitnami/os-shell
Created 22 May 2026
Facilitated by FOCIS, within ALASCA
Contributors Cloud&Heat (Tarook) and dNation (Arko)
Schedule "7 15 * * *" > every day at 15:47,

Why was this necessary?

Starting 28 August 2025, Bitnami restricted access to its ready-to-deploy container images: users now need a paid plan or have to compile the images themselves from source. This broke the way several ALASCA projects consumed Helm charts and containers from Bitnami, in particular the Thanos dependency used by:

As an immediate stopgap both projects switched to bitnamilegacy/thanos, but that image is no longer maintained, leaving an unresolved security and maintenance risk. Several alternatives were evaluated and discarded by the TSC and/or the developers — mostly because adding new upstream projects lacked a clear maintenance strategy, or because privately owned repositories don't fit secure, trusted deployment environments. A lasting, in-house solution was needed.

How it works

The key realisation: the Bitnami charts repository itself is still under Apache 2.0 — only the prebuilt images became restricted. So the build step is moved into the ALASCA domain, the image references are swapped to the Apache 2.0 upstream image published by the Thanos project, and the result is republished as alasca-thanos. The CI pipeline has three stages:

  1. discover — Lists the Thanos chart versions Bitnami publishes (via crane) and the upstream chart git tags, compares them against what is already in ALASCA's Helm registry, and emits only the new versions to build — everything from 17.2.0 upward that has not been published yet.
  2. build — For each new version it clones the Bitnami chart at that tag, renames it to alasca-thanos, and repoints it to upstream images (thanosio/thanos, plus bitnami/os-shell for the volume-permissions init step). Attribution is preserved: the upstream LICENSE is copied, a NOTICE file credits Broadcom and records ALASCA's modifications, and original-author / original-license / original-source annotations are written into Chart.yaml. It also sets global.security.allowInsecureImages: true (required once the image is no longer the signed Bitnami one), then runs helm dependency update, helm package and helm lint.
  3. publish — Uploads each packaged chart to the project's GitLab Helm chart registry, skipping any version already present, so re-runs are idempotent.

Because discovery and de-duplication are built into the pipeline, simply re-running it (for example on a schedule) automatically picks up and builds any new Bitnami Thanos release without rebuilding existing ones.