bitwarden/helm-charts self-host-2.0.0

on GitHub

A Helm chart for deploying a Bitwarden instance on Kubernetes

⚠️ Self-host Helm chart v2.0.0 introduces breaking changes ⚠️

This is a major version release of the Bitwarden Self-host Helm chart and includes two changes that may require action before upgrading. Please review the items below and update your values.yaml accordingly before running helm upgrade.

🚨 Change 1: Kubernetes Ingress is no longer the default; Gateway API is recommended

The Kubernetes Ingress resource is still supported, but it is no longer the recommended default and is now disabled by default (general.ingress.enabled defaults to false). New deployments should use the Gateway API, which is the preferred path forward for routing traffic to your Bitwarden self-host deployment on Kubernetes.

This change is also motivated by upstream: the chart's default ingress controller, ingress-nginx (className: "nginx"), was retired by the Kubernetes project in March 2026 and no longer receives releases, bug fixes, or security patches.

Action Required

If you currently rely on the chart-managed Ingress resource, you have two options:

Option A (recommended): Migrate to Gateway API

Enable Gateway API in your values.yaml:

general:
  gateway:
    enabled: true

See the Gateway API section of the self-host chart README for full migration guidance, including required CRDs and GatewayClass configuration.

Option B: Continue using Ingress

Ingress remains available in this release but is opt-in. To preserve the prior behavior, explicitly enable it:

general:
  ingress:
    enabled: true

⚠️ If you keep using Ingress, be aware that the default ingress-nginx controller is no longer maintained. Plan to migrate to Gateway API or another maintained ingress controller.

🚨 Change 2: image.name field has been removed in favor of image.repository

In a previous release we introduced image.repository as the standard Helm pattern for image configuration, with image.name retained for backward compatibility. As of v2.0.0, the deprecated image.name field has been removed. All component image configuration must now use image.repository.

Action Required

Update your values.yaml to rename image.name → image.repository everywhere it appears in your configuration. If you are using the default values, you will not need to make any changes.

Example:

# Old
supportComponents:
  kubectl:
    image:
      name: ghcr.io/bitwarden/helm-charts/kubectl
      tag: 1.34

# New
supportComponents:
  kubectl:
    image:
      repository: ghcr.io/bitwarden/helm-charts/kubectl
      tag: 1.34

What's Changed

Full Changelog: self-host-1.1.12...self-host-2.0.0

What's Changed

• [SHOT-111] Finalize image repository changes for v2 by @mimartin12 in #508
• fix typo on refresh token var by @keithhubner in #516
• Fixed cert password gen by @keithhubner in #513
• deprecate ingress by @keithhubner in #515
• Update alpine/kubectl Docker tag to v1.36.1 by @app/renovate in #519
• updated wording and schema by @keithhubner in #525
• Add imagePullSecrets for all deployments by @mimartin12 in #524
• Update Helm chart versions: core 2026.5.0, web 2026.5.0 by @app/bre-deploy in #526

Full Changelog: self-host-1.1.12...self-host-2.0.0