feat(flame-hub): replace Bitnami PostgreSQL subchart with self-hosted Postgres

[tada5hi]

Why

Bitnami's licensing change moved its maintained images behind a paid Bitnami Secure subscription (the chart already pins bitnamilegacy/* images as a stopgap). We need to drop the Bitnami postgresql subchart.

This is a deliberately lighter-weight alternative to the CloudNativePG migration in #147. #147 also switches Harbor Bitnami → goharbor, adds the CNPG operator + migration scripts, and hardcodes shared resource names (flame-hub-postgresql-primary, flame-hub-postgres-auth, …), so deploying the chart more than once per namespace requires overriding ~9–15 variables "kept in sync". This PR avoids all of that.

What

Replace the Bitnami postgresql subchart with a minimal, operator-free single-node PostgreSQL StatefulSet built on the official postgres image, authored directly in flame-hub.

It keeps the exact release-scoped contract the rest of the chart already relies on, so nothing else had to change:

• Service published as {{ .Release.Name }}-postgresql-primary on 5432 — the host Harbor's externalDatabase, authup, and the server-core/storage/telemetry services already point at.
• Superuser password sourced from the shared flame-hub-auth credentials secret (key postgresql-password), via the existing flameHub.effectiveSecretName helper.
• An init ConfigMap pre-creates the core, storage, telemetry, auth, and registry databases (plus Harbor's schema_migrations bookkeeping table), mirroring the previous Bitnami initdb script.

Result: Bitnami-free Postgres, the single-secret + release-scoped design preserved, and zero-override multi-deploy in one namespace still works. Harbor stays on the Bitnami Harbor chart, which already sources host/port/user from release-templated values + the password from the existing secret.

Changes

• Chart.yaml — drop the Bitnami postgresql dependency.
• templates/postgresql/{statefulset,service,configmap-init}.yaml — new self-hosted Postgres.
• values.yaml — swap the Bitnami postgresql: block for a small self-owned one (image, persistence, init databases, max_connections, secret/key refs).

Validation

• helm lint → 0 failed.
• helm template (full chart) → renders; exactly one Postgres StatefulSet, and all consumers + Harbor still resolve to flame-hub-postgresql-primary:5432.

Notes / follow-ups

• credentials-secret.yaml still emits an (now unused) postgresql-replication-password key — harmless single-node leftover; left out of scope to keep this diff focused.
• Single-node by design (current values already ran readReplicas.replicaCount: 0). If HA/metrics/backups are needed later, that's the heavier CNPG route.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c7f6ca2e-9492-42ab-be5f-432e477008e3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/self-hosted-postgresql

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}