[bitnamicharts/kafka] Back-off pulling image "docker.io/bitnami/kafka:4.0.0-debian-12-r0"

[nvhuu99]

Name and Version

bitnamicharts/kafka:32.0.1

What steps will reproduce the bug?

Summary:

1. Environment: kind - Kubernetes
2. Configs: I did not overrides any configs
3. Run helm install kafka oci://registry-1.docker.io/bitnamicharts/kafka --version 32.0.1. Then run kubectl describe pod/kafka-controller-0
4. Error: Back-off pulling image "docker.io/bitnami/kafka:4.0.0-debian-12-r0"

I check Dockerhub, but I can't find any tags. I think it have been moved from bitnami/kafka to bitnamicharts/kafka.

Then, I tried to change the image to a newer version with these values, but it didn't work out:

# values.yaml

global:
  security:
    allowInsecureImages: true

image:
  registry: docker.io
  repository: bitnamicharts/kafka
  tag: 32.4.3
  pullPolicy: Never

Please suggest the correct repo + image + version. Thank you.

Are you using any custom parameters or values?

No, I am not

What do you see instead?

$ helm install kafka oci://registry-1.docker.io/bitnamicharts/kafka --version 32.0.1
Pulled: registry-1.docker.io/bitnamicharts/kafka:32.0.1
Digest: sha256:2b71ecd47ab5293f13d27fab408dd7b2b16588a3578f229bea0b17b963cf52f0
NAME: kafka
LAST DEPLOYED: Thu Oct  2 21:29:08 2025
NAMESPACE: kafka-test
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
CHART NAME: kafka
CHART VERSION: 32.0.1
APP VERSION: 4.0.0

Did you know there are enterprise versions of the Bitnami catalog? For enhanced secure software supply chain features, unlimited pulls from Docker, LTS support, or application customization, see Bitnami Premium or Tanzu Application Catalog. See https://www.arrow.com/globalecs/na/vendors/bitnami for more information.

** Please be patient while the chart is being deployed **

Kafka can be accessed by consumers via port 9092 on the following DNS name from within your cluster:

    kafka.kafka-test.svc.cluster.local

Each Kafka broker can be accessed by producers via port 9092 on the following DNS name(s) from within your cluster:

    kafka-controller-0.kafka-controller-headless.kafka-test.svc.cluster.local:9092
    kafka-controller-1.kafka-controller-headless.kafka-test.svc.cluster.local:9092
    kafka-controller-2.kafka-controller-headless.kafka-test.svc.cluster.local:9092

The CLIENT listener for Kafka client connections from within your cluster have been configured with the following security settings:
    - SASL authentication

To connect a client to your Kafka, you need to create the 'client.properties' configuration files with the content below:

security.protocol=SASL_PLAINTEXT
sasl.mechanism=SCRAM-SHA-256
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required \
    username="user1" \
    password="$(kubectl get secret kafka-user-passwords --namespace kafka-test -o jsonpath='{.data.client-passwords}' | base64 -d | cut -d , -f 1)";

To create a pod that you can use as a Kafka client run the following commands:

    kubectl run kafka-client --restart='Never' --image docker.io/bitnami/kafka:4.0.0-debian-12-r0 --namespace kafka-test --command -- sleep infinity
    kubectl cp --namespace kafka-test /path/to/client.properties kafka-client:/tmp/client.properties
    kubectl exec --tty -i kafka-client --namespace kafka-test -- bash

    PRODUCER:
        kafka-console-producer.sh \
            --producer.config /tmp/client.properties \
            --bootstrap-server kafka.kafka-test.svc.cluster.local:9092 \
            --topic test

    CONSUMER:
        kafka-console-consumer.sh \
            --consumer.config /tmp/client.properties \
            --bootstrap-server kafka.kafka-test.svc.cluster.local:9092 \
            --topic test \
            --from-beginning

WARNING: There are "resources" sections in the chart not set. Using "resourcesPreset" is not recommended for production. For production installations, please set the following values according to your workload needs:
  - controller.resources
  - defaultInitContainers.prepareConfig.resources
+info https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

$ kubectl describe pod/kafka-controller-0
Name:             kafka-controller-0
Namespace:        kafka-test
Priority:         0
Service Account:  kafka
Node:             kind-worker2/172.19.0.3
Start Time:       Thu, 02 Oct 2025 21:29:09 +0700
Labels:           app.kubernetes.io/component=controller-eligible
                  app.kubernetes.io/instance=kafka
                  app.kubernetes.io/managed-by=Helm
                  app.kubernetes.io/name=kafka
                  app.kubernetes.io/part-of=kafka
                  app.kubernetes.io/version=4.0.0
                  apps.kubernetes.io/pod-index=0
                  controller-revision-hash=kafka-controller-bf44c75c7
                  helm.sh/chart=kafka-32.0.1
                  statefulset.kubernetes.io/pod-name=kafka-controller-0
Annotations:      checksum/configuration: b1e8aa78a8e50af2f90d01010582286b039f3ff349d0146023847ca626d55abb
                  checksum/passwords-secret: 1da98cec81e460cc4d3781fe3aa323bd5e824f308350e091847a45778ff22547
Status:           Pending
SeccompProfile:   RuntimeDefault
IP:               10.244.1.20
IPs:
  IP:           10.244.1.20
Controlled By:  StatefulSet/kafka-controller
Init Containers:
  prepare-config:
    Container ID:
    Image:           docker.io/bitnami/kafka:4.0.0-debian-12-r0
    Image ID:
    Port:            <none>
    Host Port:       <none>
    SeccompProfile:  RuntimeDefault
    Command:
      /bin/bash
    Args:
      -ec
      . /opt/bitnami/scripts/libkafka.sh
      configure_kafka_sasl() {
          # Replace placeholders with passwords
          replace_in_file "$KAFKA_CONF_FILE" "interbroker-password-placeholder" "$KAFKA_INTER_BROKER_PASSWORD"
          replace_in_file "$KAFKA_CONF_FILE" "controller-password-placeholder" "$KAFKA_CONTROLLER_PASSWORD"
          read -r -a passwords <<< "$(tr ',;' ' ' <<<"${KAFKA_CLIENT_PASSWORDS:-}")"
          for ((i = 0; i < ${#passwords[@]}; i++)); do
              replace_in_file "$KAFKA_CONF_FILE" "password-placeholder-${i}\"" "${passwords[i]}\""
          done
      }

      cp /configmaps/server.properties $KAFKA_CONF_FILE

      # Get pod ID and role, last and second last fields in the pod name respectively
      POD_ID="${MY_POD_NAME##*-}"
      POD_ROLE="${MY_POD_NAME%-*}"; POD_ROLE="${POD_ROLE##*-}"

      # Configure node.id
      ID=$((POD_ID + KAFKA_MIN_ID))
      [[ -f "/bitnami/kafka/data/meta.properties" ]] && ID="$(grep "node.id" /bitnami/kafka/data/meta.properties | awk -F '=' '{print $2}')"
      kafka_server_conf_set "node.id" "$ID"
      # Configure initial controllers
      if [[ "controller" =~ "$POD_ROLE" ]]; then
          INITIAL_CONTROLLERS=()
          for ((i = 0; i < 3; i++)); do
              var="KAFKA_CONTROLLER_${i}_DIR_ID"; DIR_ID="${!var}"
              [[ $i -eq $POD_ID ]] && [[ -f "/bitnami/kafka/data/meta.properties" ]] && DIR_ID="$(grep "directory.id" /bitnami/kafka/data/meta.properties | awk -F '=' '{print $2}')"
              INITIAL_CONTROLLERS+=("${i}@${KAFKA_FULLNAME}-${POD_ROLE}-${i}.${KAFKA_CONTROLLER_SVC_NAME}.${MY_POD_NAMESPACE}.svc.${CLUSTER_DOMAIN}:${KAFKA_CONTROLLER_PORT}:${DIR_ID}")
          done
          echo "${INITIAL_CONTROLLERS[*]}" | awk -v OFS=',' '{$1=$1}1' > /shared/initial-controllers.txt
      fi
      replace_in_file "$KAFKA_CONF_FILE" "advertised-address-placeholder" "${MY_POD_NAME}.${KAFKA_FULLNAME}-${POD_ROLE}-headless.${MY_POD_NAMESPACE}.svc.${CLUSTER_DOMAIN}"
      sasl_env_vars=(
        KAFKA_CLIENT_PASSWORDS
        KAFKA_INTER_BROKER_PASSWORD
        KAFKA_INTER_BROKER_CLIENT_SECRET
        KAFKA_CONTROLLER_PASSWORD
        KAFKA_CONTROLLER_CLIENT_SECRET
      )
      for env_var in "${sasl_env_vars[@]}"; do
          file_env_var="${env_var}_FILE"
          if [[ -n "${!file_env_var:-}" ]]; then
              if [[ -r "${!file_env_var:-}" ]]; then
                  export "${env_var}=$(< "${!file_env_var}")"
                  unset "${file_env_var}"
              else
                  warn "Skipping export of '${env_var}'. '${!file_env_var:-}' is not readable."
              fi
          fi
      done
      configure_kafka_sasl
      if [[ -f /secret-config/server-secret.properties ]]; then
          cat /secret-config/server-secret.properties >> $KAFKA_CONF_FILE
      fi

    State:          Waiting
      Reason:       ImagePullBackOff
    Ready:          False
    Restart Count:  0
    Limits:
      cpu:                150m
      ephemeral-storage:  2Gi
      memory:             192Mi
    Requests:
      cpu:                100m
      ephemeral-storage:  50Mi
      memory:             128Mi
    Environment:
      BITNAMI_DEBUG:                     false
      MY_POD_NAME:                       kafka-controller-0 (v1:metadata.name)
      MY_POD_NAMESPACE:                  kafka-test (v1:metadata.namespace)
      KAFKA_FULLNAME:                    kafka
      CLUSTER_DOMAIN:                    cluster.local
      KAFKA_VOLUME_DIR:                  /bitnami/kafka
      KAFKA_CONF_FILE:                   /config/server.properties
      KAFKA_MIN_ID:                      0
      KAFKA_CONTROLLER_SVC_NAME:         kafka-controller-headless
      KAFKA_CONTROLLER_PORT:             9093
      KAFKA_CONTROLLER_0_DIR_ID:         <set to the key 'controller-0-id' in secret 'kafka-kraft'>  Optional: false
      KAFKA_CONTROLLER_1_DIR_ID:         <set to the key 'controller-1-id' in secret 'kafka-kraft'>  Optional: false
      KAFKA_CONTROLLER_2_DIR_ID:         <set to the key 'controller-2-id' in secret 'kafka-kraft'>  Optional: false
      KAFKA_CLIENT_USERS:                user1
      KAFKA_CLIENT_PASSWORDS_FILE:       /opt/bitnami/kafka/config/secrets/client-passwords
      KAFKA_INTER_BROKER_USER:           inter_broker_user
      KAFKA_INTER_BROKER_PASSWORD_FILE:  /opt/bitnami/kafka/config/secrets/inter-broker-password
      KAFKA_CONTROLLER_USER:             controller_user
      KAFKA_CONTROLLER_PASSWORD_FILE:    /opt/bitnami/kafka/config/secrets/controller-password
    Mounts:
      /bitnami/kafka from data (rw)
      /config from kafka-config (rw)
      /configmaps from kafka-configmaps (rw)
      /opt/bitnami/kafka/config/secrets from kafka-sasl (ro)
      /secret-config from kafka-secret-config (rw)
      /shared from init-shared (rw)
      /tmp from tmp (rw)
Containers:
  kafka:
    Container ID:
    Image:          docker.io/bitnami/kafka:4.0.0-debian-12-r0
    Image ID:
    Ports:          9093/TCP, 9092/TCP, 9094/TCP
    Host Ports:     0/TCP, 0/TCP, 0/TCP
    State:          Waiting
      Reason:       PodInitializing
    Ready:          False
    Restart Count:  0
    Limits:
      cpu:                750m
      ephemeral-storage:  2Gi
      memory:             768Mi
    Requests:
      cpu:                500m
      ephemeral-storage:  50Mi
      memory:             512Mi
    Liveness:             exec [pgrep -f kafka] delay=10s timeout=5s period=10s #success=1 #failure=3
    Readiness:            tcp-socket :controller delay=5s timeout=5s period=10s #success=1 #failure=6
    Environment:
      KAFKA_HEAP_OPTS:                    -Xmx1024m -Xms1024m
      KAFKA_CFG_PROCESS_ROLES:            controller,broker
      KAFKA_INITIAL_CONTROLLERS_FILE:     /shared/initial-controllers.txt
      BITNAMI_DEBUG:                      false
      KAFKA_KRAFT_CLUSTER_ID:             <set to the key 'cluster-id' in secret 'kafka-kraft'>  Optional: false
      KAFKA_KRAFT_BOOTSTRAP_SCRAM_USERS:  true
      KAFKA_CLIENT_USERS:                 user1
      KAFKA_CLIENT_PASSWORDS_FILE:        /opt/bitnami/kafka/config/secrets/client-passwords
      KAFKA_INTER_BROKER_USER:            inter_broker_user
      KAFKA_INTER_BROKER_PASSWORD_FILE:   /opt/bitnami/kafka/config/secrets/inter-broker-password
      KAFKA_CONTROLLER_USER:              controller_user
      KAFKA_CONTROLLER_PASSWORD_FILE:     /opt/bitnami/kafka/config/secrets/controller-password
    Mounts:
      /bitnami/kafka from data (rw)
      /opt/bitnami/kafka/config/secrets from kafka-sasl (ro)
      /opt/bitnami/kafka/config/server.properties from kafka-config (rw,path="server.properties")
      /opt/bitnami/kafka/logs from logs (rw)
      /shared from init-shared (rw)
      /tmp from tmp (rw)
Conditions:
  Type                        Status
  PodReadyToStartContainers   True
  Initialized                 False
  Ready                       False
  ContainersReady             False
  PodScheduled                True
Volumes:
  data:
    Type:       PersistentVolumeClaim (a reference to a PersistentVolumeClaim in the same namespace)
    ClaimName:  data-kafka-controller-0
    ReadOnly:   false
  kafka-configmaps:
    Type:      ConfigMap (a volume populated by a ConfigMap)
    Name:      kafka-controller-configuration
    Optional:  false
  kafka-secret-config:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  <unset>
  kafka-config:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  <unset>
  tmp:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  <unset>
  init-shared:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  <unset>
  kafka-sasl:
    Type:                Projected (a volume that contains injected data from multiple sources)
    SecretName:          kafka-user-passwords
    SecretOptionalName:  <nil>
  logs:
    Type:        EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:   <unset>
QoS Class:       Burstable
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                 node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type     Reason     Age               From               Message
  ----     ------     ----              ----               -------
  Normal   Scheduled  16s               default-scheduler  Successfully assigned kafka-test/kafka-controller-0 to kind-worker2
  Warning  Failed     13s               kubelet            Failed to pull image "docker.io/bitnami/kafka:4.0.0-debian-12-r0": rpc error: code = NotFound desc = failed to pull and u
npack image "docker.io/bitnami/kafka:4.0.0-debian-12-r0": failed to resolve reference "docker.io/bitnami/kafka:4.0.0-debian-12-r0": docker.io/bitnami/kafka:4.0.0-debian-12-r0: not found
  Warning  Failed     13s               kubelet            Error: ErrImagePull
  Normal   BackOff    13s               kubelet            Back-off pulling image "docker.io/bitnami/kafka:4.0.0-debian-12-r0"
  Warning  Failed     13s               kubelet            Error: ImagePullBackOff
  Normal   Pulling    1s (x2 over 15s)  kubelet            Pulling image "docker.io/bitnami/kafka:4.0.0-debian-12-r0"

[Fitzsimmons]

All of the images are gone from dockerhub https://hub.docker.com/r/bitnami/external-dns/tags

[carrodher]

With the changes announced at bitnami/containers#83267, the container images were removed from docker.io/bitnami and moved to docker.io/bitnamilegacy, where they will no longer receive updates. To continue getting new, hardened image versions, a Bitnami Secure Images subscription is required.

See the pinned issue linked above for full details.

[nvhuu99]

I will use the lagacy image:

• bitnamilegacy/kafka:4.0.0-debian-12-r10