Use posit-dev images for Workbench chart

Migrate rstudio-workbench Helm chart from legacy rstudio/ Docker Hub
images to new ghcr.io/posit-dev/ container images.

- workbench replaces rstudio/rstudio-workbench
- workbench-session replaces rstudio/r-session-complete
- Tag format changes from {os}{version} to {version}-{os}
- Session tag format: R{rVersion}-python{pythonVersion}-{os}
- image.tagPrefix replaced by image.os
- session.image.tagPrefix replaced by os, rVersion, pythonVersion
- Add session.defaultInitContainer for workbench-session-init
- Add configmap unit tests for session-init container
- Bump chart version to 0.20.0

Author: bschwedler

charts/rstudio-workbench/Chart.yaml

@@ -1,6 +1,6 @@
 name: rstudio-workbench
 description: Official Helm chart for Posit Workbench
-version: 0.10.13
+version: 0.20.0
 apiVersion: v2
 appVersion: 2026.01.2
 icon:
@@ -18,10 +18,10 @@ dependencies:
     repository: https://helm.rstudio.com
 annotations:
   artifacthub.io/images: |
-    - name: rstudio-workbench
-      image: rstudio/rstudio-workbench:ubuntu2204-2026.01.2
-    - name: r-session-complete
-      image: rstudio/r-session-complete:ubuntu2204-2026.01.2
+    - name: workbench
+      image: posit/workbench:2026.01.2-ubuntu-24.04
+    - name: workbench-session
+      image: posit/workbench-session:R4.5.2-python3.14.3-ubuntu-24.04
   artifacthub.io/license: MIT
   artifacthub.io/links: |
     - name: Docker Images

charts/rstudio-workbench/NEWS.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.20.0
+
+- BREAKING: Default images now use `posit/workbench` instead of `rstudio/rstudio-workbench`
+- BREAKING: Session images now use `posit/workbench-session` instead of `rstudio/r-session-complete`
+- BREAKING: Image tag format changed from `{os}{version}` to `{version}-{os}`; session tag format changed to `R{rVersion}-python{pythonVersion}-{os}`
+- BREAKING: `image.tagPrefix` replaced by `image.os`; `session.image.tagPrefix` replaced by `session.image.os`, `session.image.rVersion`, and `session.image.pythonVersion`
+- Add `session.defaultInitContainer` for Workbench Session Init image (`posit/workbench-session-init`)
+
 
 ## 0.10.13
 

charts/rstudio-workbench/README.md

@@ -1,6 +1,6 @@
 # Posit Workbench
 
-![Version: 0.10.13](https://img.shields.io/badge/Version-0.10.13-informational?style=flat-square) ![AppVersion: 2026.01.2](https://img.shields.io/badge/AppVersion-2026.01.2-informational?style=flat-square)
+![Version: 0.20.0](https://img.shields.io/badge/Version-0.20.0-informational?style=flat-square) ![AppVersion: 2026.01.2](https://img.shields.io/badge/AppVersion-2026.01.2-informational?style=flat-square)
 
 #### _Official Helm chart for Posit Workbench_
 
@@ -24,11 +24,11 @@ To ensure a stable production deployment:
 
 ## Installing the chart
 
-To install the chart with the release name `my-release` at version 0.10.13:
+To install the chart with the release name `my-release` at version 0.20.0:
 
 ```{.bash}
 helm repo add rstudio https://helm.rstudio.com
-helm upgrade --install my-release rstudio/rstudio-workbench --version=0.10.13
+helm upgrade --install my-release rstudio/rstudio-workbench --version=0.20.0
 ```
 
 To explore other chart versions, look at:
@@ -615,9 +615,9 @@ Use of [Sealed secrets](https://github.com/bitnami-labs/sealed-secrets) disables
 | homeStorage.volumeName | string | `""` | the volumeName passed along to the persistentVolumeClaim. Optional |
 | image.imagePullPolicy | string | `"IfNotPresent"` | the imagePullPolicy for the main pod image |
 | image.imagePullSecrets | list | `[]` | an array of kubernetes secrets for pulling the main pod image from private registries |
-| image.repository | string | `"rstudio/rstudio-workbench"` | the repository to use for the main pod image |
+| image.os | string | `"ubuntu-24.04"` | The OS version for the image tag (e.g. ubuntu-24.04, ubuntu-22.04). Only used if tag is not defined |
+| image.repository | string | `"posit/workbench"` | the repository to use for the main pod image |
 | image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
-| image.tagPrefix | string | `"ubuntu2204-"` | A tag prefix for the server image (common selection: ubuntu2204-). Only used if tag is not defined |
 | ingress.annotations | object | `{}` |  |
 | ingress.enabled | bool | `false` |  |
 | ingress.hosts | string | `nil` |  |
@@ -698,10 +698,20 @@ Use of [Sealed secrets](https://github.com/bitnami-labs/sealed-secrets) disables
 | serviceMonitor.namespace | string | `""` | Namespace to create the ServiceMonitor in (usually the same as the one in which the Prometheus Operator is running). Defaults to the release namespace |
 | session.defaultConfigMount | bool | `true` | Whether to automatically mount the config.session configuration into session pods. If launcher.namespace is different from Release Namespace, then the chart will duplicate the session configmap in both namespaces to facilitate this |
 | session.defaultHomeMount | bool | `true` | Whether to automatically add the homeStorage PVC to the session (i.e. via the `launcher-mounts` file) |
+| session.defaultInitContainer | object | `{"enabled":true,"imagePullPolicy":"","os":"ubuntu-24.04","repository":"posit/workbench-session-init","resources":{},"securityContext":{},"tag":""}` | Image definition for the default Workbench Session InitContainer |
+| session.defaultInitContainer.enabled | bool | `true` | Whether to enable the defaultInitContainer. Copies session runtime components into a shared volume for the session container. |
+| session.defaultInitContainer.imagePullPolicy | string | `""` | The imagePullPolicy for the default initContainer |
+| session.defaultInitContainer.os | string | `"ubuntu-24.04"` | The OS version for the image tag (e.g. ubuntu-24.04, ubuntu-22.04). Only used if tag is not defined |
+| session.defaultInitContainer.repository | string | `"posit/workbench-session-init"` | The repository to use for the Session InitContainer image |
+| session.defaultInitContainer.resources | object | `{}` | Optional resources for the default initContainer |
+| session.defaultInitContainer.securityContext | object | `{}` | The securityContext for the default initContainer |
+| session.defaultInitContainer.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
 | session.defaultSecretMountPath | string | `"/mnt/session-secret/"` | The path to mount the sessionSecret (from `config.sessionSecret`) onto the server and session pods |
-| session.image.repository | string | `"rstudio/r-session-complete"` | The repository to use for the session image |
-| session.image.tag | string | `""` | A tag override for the session image. Overrides the "tagPrefix" above, if set. Default tag is `{{ tagPrefix }}{{ version }}` |
-| session.image.tagPrefix | string | `"ubuntu2204-"` | A tag prefix for session images (common selections: ubuntu2204-, centos7-). Only used if tag is not defined |
+| session.image.os | string | `"ubuntu-24.04"` | The OS version for the session image tag (e.g. ubuntu-24.04, ubuntu-22.04). Only used if tag is not defined |
+| session.image.pythonVersion | string | `"3.14.3"` | The Python version for the session image tag. Only used if tag is not defined |
+| session.image.rVersion | string | `"4.5.2"` | The R version for the session image tag. Only used if tag is not defined |
+| session.image.repository | string | `"posit/workbench-session"` | The repository to use for the session image |
+| session.image.tag | string | `""` | A tag override for the session image. Overrides rVersion, pythonVersion, and os. Default tag is `R{{ rVersion }}-python{{ pythonVersion }}-{{ os }}` |
 | shareProcessNamespace | bool | `false` | whether to provide `shareProcessNamespace` to the pod. |
 | sharedStorage.accessModes | list | `["ReadWriteMany"]` | accessModes defined for the storage PVC (represented as YAML) |
 | sharedStorage.annotations | object | `{"helm.sh/resource-policy":"keep"}` | Define the annotations for the Persistent Volume Claim resource |

charts/rstudio-workbench/templates/_helpers.tpl

@@ -29,7 +29,7 @@ If release name contains chart name it will be used as a full name.
 containers:
 - name: rstudio
   {{- $defaultVersion := .Values.versionOverride | default $.Chart.AppVersion }}
-  {{- $imageTag := .Values.image.tag | default (printf "%s%s" .Values.image.tagPrefix $defaultVersion )}}
+  {{- $imageTag := .Values.image.tag | default (printf "%s-%s" $defaultVersion .Values.image.os )}}
   image: "{{ .Values.image.repository }}:{{ $imageTag }}"
   {{- with .Values.pod.lifecycle }}
   lifecycle:

charts/rstudio-workbench/templates/configmap-general.yaml

@@ -1,6 +1,6 @@
 {{- /* Define the default values that will be merged over */}}
 {{- $defaultVersion := .Values.versionOverride | default $.Chart.AppVersion }}
-{{- $sessionTag := .Values.session.image.tag | default (printf "%s%s" .Values.session.image.tagPrefix $defaultVersion ) }}
+{{- $sessionTag := .Values.session.image.tag | default (printf "R%s-python%s-%s" .Values.session.image.rVersion .Values.session.image.pythonVersion .Values.session.image.os ) }}
 {{- $defaultImages := list (printf "%s:%s" .Values.session.image.repository $sessionTag) }}
 {{- $defaultOverrides := list }}
 {{- $sessionTemplate := deepCopy .Values.launcher.templateValues }}
@@ -39,6 +39,29 @@
     {{- end }}
   {{- end }}
 {{- end }}
+{{- if .Values.session.defaultInitContainer.enabled }}
+  {{- /* session-init container: copies session runtime components into a shared volume */ -}}
+  {{- $initTag := .Values.session.defaultInitContainer.tag | default (printf "%s-%s" $defaultVersion .Values.session.defaultInitContainer.os) }}
+  {{- $initImage := printf "%s:%s" .Values.session.defaultInitContainer.repository $initTag }}
+  {{- $initPullPolicy := default "IfNotPresent" .Values.session.defaultInitContainer.imagePullPolicy }}
+  {{- $sessionComponentsVolume := dict "name" "session-components" "emptyDir" (dict) }}
+  {{- $sessionComponentsMount := dict "name" "session-components" "mountPath" "/opt/session-components" }}
+  {{- $initContainerJson := dict "name" "workbench-session-init" "image" $initImage "imagePullPolicy" $initPullPolicy "resources" .Values.session.defaultInitContainer.resources "securityContext" .Values.session.defaultInitContainer.securityContext "volumeMounts" (list $sessionComponentsMount) }}
+  {{- /* for non-template path (job-json-overrides) */ -}}
+  {{- $initOverride := dict "name" "defaultSessionInitContainer" "target" "/spec/template/spec/initContainers/0" "json" $initContainerJson }}
+  {{- $volumeOverride := dict "name" "defaultSessionComponentsVolume" "target" "/spec/template/spec/volumes/-" "json" $sessionComponentsVolume }}
+  {{- $mountOverride := dict "name" "defaultSessionComponentsMount" "target" "/spec/template/spec/containers/0/volumeMounts/-" "json" $sessionComponentsMount }}
+  {{- $defaultOverrides = concat $defaultOverrides (list $initOverride $volumeOverride $mountOverride) }}
+  {{- /* for template path */ -}}
+  {{- if .Values.launcher.useTemplates }}
+    {{- $initList := append $sessionTemplate.pod.initContainers $initContainerJson }}
+    {{- $_ := set $sessionTemplate.pod "initContainers" $initList }}
+    {{- $volumeList3 := append $sessionTemplate.pod.volumes $sessionComponentsVolume }}
+    {{- $_ := set $sessionTemplate.pod "volumes" $volumeList3 }}
+    {{- $mountList3 := append $sessionTemplate.pod.volumeMounts $sessionComponentsMount }}
+    {{- $_ := set $sessionTemplate.pod "volumeMounts" $mountList3 }}
+  {{- end }}
+{{- end }}
 {{- if .Values.launcher.useTemplates }}
   {{- /* this sets defaultOverrides to be empty if we are using templating */ -}}
   {{- $defaultOverrides = list }}

charts/rstudio-workbench/tests/configmap_test.yaml

@@ -0,0 +1,46 @@
+suite: Workbench ConfigMap
+templates:
+  - configmap-general.yaml
+  - configmap-prestart.yaml
+  - configmap-secret.yaml
+  - configmap-session.yaml
+tests:
+  - it: should include session-init container in template data by default
+    template: configmap-general.yaml
+    documentIndex: 1
+    asserts:
+      - matchRegex:
+          path: data["rstudio-library-templates-data.tpl"]
+          pattern: "workbench-session-init"
+      - matchRegex:
+          path: data["rstudio-library-templates-data.tpl"]
+          pattern: "posit/workbench-session-init:2026.01.2-ubuntu-24.04"
+      - matchRegex:
+          path: data["rstudio-library-templates-data.tpl"]
+          pattern: "session-components"
+
+  - it: should use custom session-init image when tag is overridden
+    template: configmap-general.yaml
+    documentIndex: 1
+    set:
+      session:
+        defaultInitContainer:
+          enabled: true
+          repository: "custom-repo/session-init"
+          tag: "custom-tag"
+    asserts:
+      - matchRegex:
+          path: data["rstudio-library-templates-data.tpl"]
+          pattern: "custom-repo/session-init:custom-tag"
+
+  - it: should not include session-init container when disabled
+    template: configmap-general.yaml
+    documentIndex: 1
+    set:
+      session:
+        defaultInitContainer:
+          enabled: false
+    asserts:
+      - notMatchRegex:
+          path: data["rstudio-library-templates-data.tpl"]
+          pattern: "workbench-session-init"

charts/rstudio-workbench/values.yaml

@@ -21,12 +21,32 @@ session:
   # -- The path to mount the sessionSecret (from `config.sessionSecret`) onto the server and session pods
   defaultSecretMountPath: /mnt/session-secret/
   image:
-    # -- A tag prefix for session images (common selections: ubuntu2204-, centos7-). Only used if tag is not defined
-    tagPrefix: ubuntu2204-
+    # -- The OS version for the session image tag (e.g. ubuntu-24.04, ubuntu-22.04). Only used if tag is not defined
+    os: "ubuntu-24.04"
+    # -- The R version for the session image tag. Only used if tag is not defined
+    rVersion: "4.5.2"
+    # -- The Python version for the session image tag. Only used if tag is not defined
+    pythonVersion: "3.14.3"
     # -- The repository to use for the session image
-    repository: "rstudio/r-session-complete"
-    # -- A tag override for the session image. Overrides the "tagPrefix" above, if set. Default tag is `{{ tagPrefix }}{{ version }}`
+    repository: "posit/workbench-session"
+    # -- A tag override for the session image. Overrides rVersion, pythonVersion, and os. Default tag is `R{{ rVersion }}-python{{ pythonVersion }}-{{ os }}`
     tag: ""
+  # -- Image definition for the default Workbench Session InitContainer
+  defaultInitContainer:
+    # -- Whether to enable the defaultInitContainer. Copies session runtime components into a shared volume for the session container.
+    enabled: true
+    # -- The repository to use for the Session InitContainer image
+    repository: "posit/workbench-session-init"
+    # -- The OS version for the image tag (e.g. ubuntu-24.04, ubuntu-22.04). Only used if tag is not defined
+    os: "ubuntu-24.04"
+    # -- Overrides the image tag whose default is the chart appVersion.
+    tag: ""
+    # -- The imagePullPolicy for the default initContainer
+    imagePullPolicy: ""
+    # -- Optional resources for the default initContainer
+    resources: {}
+    # -- The securityContext for the default initContainer
+    securityContext: {}
 
 sharedStorage:
   # -- whether to create the persistentVolumeClaim for shared storage
@@ -193,9 +213,9 @@ homeStorage:
 
 image:
   # -- the repository to use for the main pod image
-  repository: rstudio/rstudio-workbench
-  # -- A tag prefix for the server image (common selection: ubuntu2204-). Only used if tag is not defined
-  tagPrefix: ubuntu2204-
+  repository: posit/workbench
+  # -- The OS version for the image tag (e.g. ubuntu-24.04, ubuntu-22.04). Only used if tag is not defined
+  os: "ubuntu-24.04"
   # -- Overrides the image tag whose default is the chart appVersion.
   tag: ""
   # -- the imagePullPolicy for the main pod image