langfuse-2.0.0

langfuse 2.0.0 — Bitnami-free stack, ClickHouse operator, Langfuse v4

Chart 2.0.0 removes all Bitnami dependencies and moves every bundled store to an OSS-licensed alternative:

Component	v1.x	v2.0
PostgreSQL	bitnami/postgresql	groundhog2k/postgres
ClickHouse	bitnami/clickhouse + ZooKeeper	ClickHouse/clickhouse-operator (ClickHouseCluster + KeeperCluster)
Redis	bitnami/valkey	valkey-io/valkey
Object storage	bitnami/minio	seaweedfs/seaweedfs (allInOne)

The bundled app is now Langfuse v4 (appVersion 4.4.0, from 3.224.1) — see the
Langfuse v4 release notes for application-level changes.

⚠️ Read before upgrading from 1.x

A plain helm upgrade is blocked when v1 bundled stores are detected — StatefulSet
identities, PVC layouts, and the ClickHouse coordination backend all change, and a raw upgrade
would orphan your data. Two supported paths:

• All stores external (*.deploy: false): in-place helm upgrade with the values changes below.
• Any bundled store: sibling release + online data copy + traffic shift, designed for
  < 5 minutes of downtime. Follow the migration guide
  or its automated script. Minimum source version: Langfuse v3.224.1.
  Reuse your v1 salt, encryptionKey, and nextauth.secret — otherwise encrypted data is lost.

New prerequisites when deploying bundled ClickHouse: cluster-wide cert-manager and the
ClickHouse operator (see the README).
Helm ≥ 3.17 required.

Values changes

• clickhouse.clusterEnabled → clickhouse.cluster.enabled
• redis.extraFlags removed → redis.valkeyConfig (the default ships maxmemory-policy noeviction)
• clickhouse.keeper.enabled must stay true while clickhouse.deploy: true (the operator CRD requires it)
• <store>.auth.existingSecret with a bundled store now also requires pointing the sub-chart's
  secret reference at your Secret (see examples/minimal-installation)
• Misconfigurations that previously deployed broken now fail at render time with instructions

Credentials

All store and app credentials are auto-generated on first install, persisted across upgrades,
and protected with helm.sh/resource-policy: keep — a fresh install needs no secrets at all.
Pin any of them via value / secretKeyRef / existingSecret.

ArgoCD / helm template pipelines: lookup cannot see the cluster there, so generated
credentials would rotate on every sync. Pin all credentials explicitly in those setups.

Staying on v1

1.5.41 remains installable from both the OCI registry and the Helm repo — pin
--version 1.5.41. The 1.x line receives no further releases.

Known limitations

Tracked as follow-ups: hook-based secret generation for helm template pipelines, pod restarts
on credential rotation, seaweedfs sub-chart RBAC/SFTP-secret defaults, and migration-script
support for passwords containing quotes or backslashes (auto-generated credentials are unaffected).

What's Changed

• docs: document ClickHouse operator usage and add v4 installation example by @Steffen911 in #385
• chore: upgrade v4 guide to non-rc release by @Steffen911 in #387
• ci: bump the github-actions group with 2 updates by @dependabot[bot] in #386
• ci: bump the github-actions group with 2 updates by @dependabot[bot] in #390
• ci: bump the github-actions group with 2 updates by @dependabot[bot] in #393
• feat!: use ClickHouse operator and OSS-licensed subcharts (v2.0.0) by @cbeneke in #388
• ci: add dependency helm repos for chart-releaser + manual dispatch by @Steffen911 in #395

Full Changelog: langfuse-1.5.41...langfuse-2.0.0