feat(renovate): source vendor-ee Bitnami images from the published datasource

[leiicamundi]

Which problem does the PR fix?

Closes #6444 — source the Bitnami Premium (vendor-ee/*) image tags for Renovate from the published per-image feeds. Part of the infraex tracking issue camunda/team-infrastructure-experience#1038.

Note

The published bitnami_<image>.json feeds are live (camunda/camunda-deployment-references#2765 is merged), so Renovate can resolve the custom datasources. All supported enterprise charts (8.7 / 8.8 / 8.9) are wired. The final gate is the post-merge Renovate scan (see Post-merge validation) — that check is inherently post-merge, as it runs against main.

What

Make Renovate track the Bitnami Premium (vendor-ee/*) images from the per-image JSON feeds published by camunda-deployment-references, instead of the docker datasource against registry.camunda.cloud.

• Adds 7 customDatasources (bitnami-*-camunda, format: json), one per image.
• Adds a customManager that opts an image in via a # renovate: datasource=custom.bitnami-<x>-camunda depName=<x> versioning=<v> annotation in values-enterprise.yaml.
• Wires vendor-ee/postgresql (×3 instances each) in 8.7, 8.8 and 8.9 and disables its helm-values tracking so it is not bumped twice.

The annotation pins the Bitnami tag versioning explicitly:

# renovate: datasource=custom.bitnami-postgresql-camunda depName=postgresql versioning=regex:^(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)(-(?<compatibility>debian-\d+)-r(?<build>\d+))?$

versioning=docker is not used: it does not order across the -debian-12-rN build suffix, so the regex versioning is required to bump …-r2 → …-r9 etc.

Why

The published feed is the complete upstream tag list (including tags from before the November 2025 vendor migration, which skopeo and the Harbor proxy can no longer list) and needs no registry credentials.

Note: digest pinning is not supported on this datasource

Custom (format: json) datasources track versions only — they cannot maintain an @sha256 digest pin (no getDigest). These helm values pin a tag, not a digest, so this is fine. Any image that pins …@sha256:… (as camunda/keycloak's bases.yml did) must stay on the docker datasource — see camunda/keycloak#591.

Post-merge validation

After this merges, run a Renovate scan on camunda-platform-helm (Mend dashboard → Check this box to trigger a request for Renovate to run, or wait for the next scheduled run) and confirm:

• the vendor-ee/postgresql update branches resolve from custom.bitnami-postgresql-camunda;
• there are no Package lookup failures / Could not determine new digest repository problems.

This is the same end-to-end check that validated the camunda/keycloak wiring — its Mend log came back clean after camunda/keycloak#591.

Scope / follow-up

Wired across all renovate-tracked enterprise charts: 8.7, 8.8, 8.9 (three vendor-ee/postgresql instances each). 8.5 / 8.6 are intentionally excluded — they are out of support and already renovate-disabled. 8.10 has no values-enterprise.yaml yet; annotate it when one is added.

• vendor-ee/elasticsearch is intentionally not wired: the chart pins a plain tag (e.g. 8.19.16) while the feed uses the <x.y.z>-debian-12-rN scheme, so it needs separate handling.
• os-shell, the exporters and keycloak-config-cli use chart-default tags (no explicit tag to track).
• keycloak-ee/keycloak is the Camunda-built image and intentionally left on its current source.

Refs camunda/team-infrastructure-experience#1038.

[Copilot]

Pull request overview

This PR updates the repository’s Renovate configuration to source Bitnami Premium (vendor-ee/*) image tags from the published camunda-deployment-references per-image JSON feeds, and annotates the 8.9 enterprise values so Renovate can opt into that custom datasource for vendor-ee/postgresql.

Changes:

• Added customDatasources entries for Bitnami Premium image tag feeds hosted on camunda.github.io/camunda-deployment-references.
• Added a customManagers regex manager to update values-enterprise.yaml tags based on inline # renovate: annotations.
• Annotated the three vendor-ee/postgresql occurrences in charts/camunda-platform-8.9/values-enterprise.yaml and disabled Renovate’s helm-values tracking for that image in that file to avoid double-bumping.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
charts/camunda-platform-8.9/values-enterprise.yaml	Adds Renovate annotations to opt vendor-ee/postgresql tags into the new custom datasource/versioning scheme.
.github/renovate.json5	Introduces Bitnami JSON custom datasources, a values-enterprise regex manager, and a rule to disable helm-values updates for vendor-ee/postgresql in 8.9 enterprise values.