ERROR: Original containers have been substituted for unrecognized ones

[hongbo-miao]

Name and Version

bitnami/clickhouse:24.12.3-debian-12-r1

What architecture are you using?

None

What steps will reproduce the bug?

After I change registry by adding

image:
  registry: public.ecr.aws
  repository: bitnami/clickhouse

like

---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: production-hm-clickhouse
  namespace: production-hm-argo-cd
  labels:
    app.kubernetes.io/name: hm-clickhouse
spec:
  project: production-hm
  sources:
    - repoURL: registry-1.docker.io/bitnamicharts
      # https://artifacthub.io/packages/helm/bitnami/clickhouse
      targetRevision: 7.2.0
      chart: clickhouse
      helm:
        releaseName: hm-clickhouse
        values: |
          # https://github.com/bitnami/charts/blob/main/bitnami/clickhouse/values.yaml
          ---
          auth:
            username: admin
            existingSecret: hm-clickhouse-secret
            existingSecretKey: CLICKHOUSE_ADMIN_PASSWORD
          persistence:
            enabled: true
            accessModes: ["ReadWriteOnce"]
            size: 10Gi
            storageClass: production-hm-clickhouse-storage-class
          keeper:
            enabled: true
          zookeeper:
            enabled: false
    - repoURL: [email protected]:hongbo-miao/hongbomiao.com.git
      targetRevision: main
      path: kubernetes/argo-cd/applications/production-hm/clickhouse/kubernetes-manifests
  destination:
    namespace: production-hm-clickhouse
    server: https://kubernetes.default.svc
  syncPolicy:
    syncOptions:
      - ServerSideApply=true
    automated:
      prune: true

When I deploy by argocd app create production-hm-clickhouse --file=hm-clickhouse-application.yaml, I got error

FATA[0002] rpc error: code = InvalidArgument desc = application spec for production-hm-clickhouse is invalid: InvalidSpecError: Unable to generate manifests in : rpc error: code = Unknown desc = `helm template . --name-template hm-clickhouse --namespace production-hm-clickhouse --kube-version 1.32 --values /tmp/3845889e-a0bc-4911-a293-4c41d7757b36 <api versions removed> --include-crds` failed exit status 1: Error: execution error at (clickhouse/templates/NOTES.txt:63:4): %0A%0A%E2%9A%A0 ERROR: Original containers have been substituted for unrecognized ones. Deploying this chart with non-standard containers is likely to cause degraded security and performance, broken chart features, and missing environment variables.%0A%0AUnrecognized images:%0A  - public.ecr.aws/bitnami/clickhouse:24.12.3-debian-12-r1%0A%0AIf you are sure you want to proceed with non-standard containers, you can skip container image verification by setting the global parameter 'global.security.allowInsecureImages' to true.%0AFurther information can be obtained at https://github.com/bitnami/charts/issues/30850%0A%0AUse --debug flag to render out invalid YAML 
error: Recipe `argo-cd-app-create` failed on line 2 with exit code 20

Are you using any custom parameters or values?

No.

What is the expected behavior?

I expect no error.

What do you see instead?

Mentioned above.

Additional information

I guess it may be related to oci way to install repoURL: registry-1.docker.io/bitnamicharts (note no https meaning oci). I could be wrong.

Because for other Bitnami charts when I install by https way, when I add this to change registry

image:
  registry: public.ecr.aws
  repository: bitnami/xxx

I didn't get this error when I deploy.

[carrodher]

For more details on this issue, please take a look at the documentation here: #30850.

[hongbo-miao]

Thank you for the link @carrodher !

For images in https://gallery.ecr.aws/bitnami/ , instead of adding

global:
  security:
    allowInsecureImages: true

I guess it belongs to Bitnami as I saw it is a verified account. Does it make sense for Bitnami to whitelist it?

[carrodher]

We appreciate your input. Our team will evaluate this internally and follow up as needed.