Update nextcloud:35.0.2-apache Docker digest to 786c102

Reviewed-on: #841

manifests/_apps/certmanager_chart.yaml

@@ -35,7 +35,7 @@ spec:
     name: cluster-fun (v2)
   source:
     repoURL: 'https://charts.jetstack.io'
-    targetRevision: 1.11.0
+    targetRevision: v1.21.3
     chart: cert-manager
     helm:
       version: v3

manifests/_apps/dashboard.yaml

@@ -22,5 +22,9 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image
 
 ---

manifests/_apps/goldilocks.yaml

@@ -1,35 +1,35 @@
 
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: cluster-fun-goldilocks
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: goldilocks
-    name: cluster-fun (v2)
-  source:
-    repoURL: 'https://charts.fairwinds.com/stable'
-    targetRevision: 10.1.0
-    chart: goldilocks
-    helm:
-      version: v3
-      values: |-
-        vpa:
-          enabled: true
-        controller:
-          flags:
-            on-by-default: true
-        dashboard:
-          flags:
-            on-by-default: true
-          replicaCount: 1
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
+# apiVersion: argoproj.io/v1alpha1
+# kind: Application
+# metadata:
+#   name: cluster-fun-goldilocks
+#   namespace: argocd
+#   finalizers:
+#   - resources-finalizer.argocd.argoproj.io
+# spec:
+#   project: cluster.fun
+#   destination:
+#     namespace: goldilocks
+#     name: cluster-fun (v2)
+#   source:
+#     repoURL: 'https://charts.fairwinds.com/stable'
+#     targetRevision: 10.1.0
+#     chart: goldilocks
+#     helm:
+#       version: v3
+#       values: |-
+#         vpa:
+#           enabled: true
+#         controller:
+#           flags:
+#             on-by-default: true
+#         dashboard:
+#           flags:
+#             on-by-default: true
+#           replicaCount: 1
+#   syncPolicy:
+#     automated: {}
+#     syncOptions:
+#       - CreateNamespace=true
 
----
+# ---

manifests/_apps/homelab-accesible-check.yaml

@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cluster-fun-homelab-accessible-check
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: homelab-accessible-check
+    name: cluster-fun (v2)
+  source:
+    path: manifests/homelab-accessible-check
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+
+---

manifests/_apps/mazanoke.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: cluster-fun-tank
+  name: mazanoke
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: tank
+    namespace: mazanoke
     name: cluster-fun (v2)
   source:
-    path: manifests/tank
+    path: manifests/mazanoke
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:
@@ -23,4 +23,3 @@ spec:
     jsonPointers:
     - /data
 
----

manifests/_apps/pairdrop.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: pairdrop
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: pairdrop
+    name: cluster-fun (v2)
+  source:
+    path: manifests/pairdrop
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+

manifests/_apps/planning-poker.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: planning-poker
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: planning-poker
+    name: cluster-fun (v2)
+  source:
+    path: manifests/planning-poker
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+

manifests/_apps/reloader.yaml

@@ -12,7 +12,7 @@ spec:
     name: cluster-fun (v2)
   source:
     repoURL: 'https://stakater.github.io/stakater-charts'
-    targetRevision: v0.0.89
+    targetRevision: v0.0.129
     chart: reloader
   syncPolicy:
     automated: {}

manifests/_apps/sre-agent.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sre-agent
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: default
+    name: cluster-fun (v2)
+  source:
+    path: manifests/sre-agent
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+

manifests/_apps/trek.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: trek
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: trek
+    name: cluster-fun (v2)
+  source:
+    path: manifests/trek
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+

manifests/_apps/url-to-grist.yaml

@@ -1,23 +1,23 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: cluster-fun-mastodon-digest
+  name: url-to-grist
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: mastodon-digest
+    namespace: cloudnative-now
     name: cluster-fun (v2)
   source:
-    path: manifests/mastodon-digest
+    path: manifests/url-to-grist
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:
-    automated: {}
     syncOptions:
       - CreateNamespace=true
+    automated: {}
   ignoreDifferences:
   - kind: Secret
     jsonPointers:

manifests/_apps/vert.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vert
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: vert
+    name: cluster-fun (v2)
+  source:
+    path: manifests/vert
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+

manifests/auth-proxy/non-auth-ingress.yaml

@@ -18,6 +18,7 @@ spec:
     - ombi.cluster.fun
     - bsky-feeds.cluster.fun
     - ai.cluster.fun
+    - hermes-hooks.cluster.fun
     secretName: non-auth-proxy-ingress
   rules:
   - host: hello-world.cluster.fun
@@ -60,3 +61,13 @@ spec:
             name: tailscale-proxy
             port:
               name: non-auth
+  - host: hermes-hooks.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: non-auth

manifests/auth-proxy/proxy.yaml

@@ -46,7 +46,7 @@ spec:
           - 100.100.100.100
       containers:
       - name: proxy
-        image: rg.fr-par.scw.cloud/averagemarcus/proxy:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/proxy:latest@sha256:2a401eec859bf665e75bbb737b3b1709cd1fa74576e4ba8c7daeb63d8b3e8d51
         imagePullPolicy: Always
         env:
         - name: PROXY_DESTINATION
@@ -68,7 +68,7 @@ spec:
           mountPath: /config/
 
       - name: oauth-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.6@sha256:c3415e8660af553f5e18f5d90db050614c02493c0ac6260ac59442f6d9b12048
         args:
         - --cookie-secure=false
         - --provider=oidc

manifests/base64/base64.yaml

@@ -32,7 +32,7 @@ spec:
       priorityClassName: low
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/base64:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/base64:latest@sha256:1ec2b770a5ffe986bdfbf24094ed945191bd7b9dd27a7b3212af92a3dfcea032
         imagePullPolicy: Always
         ports:
         - containerPort: 80

manifests/blackhole/blackhole.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: black-hole
-        image: averagemarcus/black-hole:latest
+        image: averagemarcus/black-hole:latest@sha256:1e9cb8396f67aeb25a9eaaf14b369a53a7b300ae465859f10d9f0f88ef3023e1
         imagePullPolicy: Always
         ports:
         - containerPort: 9090

manifests/blog/blog.yaml

@@ -27,9 +27,18 @@ spec:
       labels:
         app: blog
     spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app: blog
+                topologyKey: kubernetes.io/hostname
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/blog:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/blog:latest@sha256:d40aa67a51924a89ad0ac6f7387a63f2f41e9bff7b5e4c6f7675cd43354b0c28
         imagePullPolicy: Always
         ports:
         - containerPort: 8000

manifests/bsky-screenshot/bsky-screenshot.yaml

@@ -29,16 +29,16 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/bsky-screenshot:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/bsky-screenshot:latest@sha256:0fae863fc3123f73aa6268a125d5bf2c2122c8a3f2aedaf129462e668e56ab23
         imagePullPolicy: Always
         ports:
         - containerPort: 80
           name: web
         resources:
           limits:
-            memory: 20Mi
+            memory: 105Mi
           requests:
-            memory: 20Mi
+            memory: 105Mi
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress

manifests/cel-tester/cel-tester.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/cel-tester:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/cel-tester:latest@sha256:caf9044a19fa0e14f92232f68c1fe808249580d33619ea3706ff935bd2853559
         imagePullPolicy: Always
         ports:
         - containerPort: 80

manifests/civo-versions/civo-versions.yaml

@@ -41,7 +41,7 @@ spec:
       priorityClassName: low
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/civo-versions:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/civo-versions:latest@sha256:90585c61b82e124f9179b60fc8231247e3b37cab76fd7c0185aeb4a4276a0ab4
         imagePullPolicy: Always
         ports:
         - containerPort: 8000

manifests/cors-proxy/cors-proxy.yaml

@@ -29,14 +29,19 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/cors-proxy:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/cors-proxy:latest@sha256:306783c26392f92af7e34d173493b0f8d6fd7623421d16a02fad26857317aeec
         imagePullPolicy: Always
         ports:
         - containerPort: 8000
           name: web
         env:
         - name: ALLOWLIST
-          value: cdn.bsky.app
+          value: cdn.bsky.app,en.wikipedia.org
+        resources:
+          requests:
+            memory: 184M
+          limits:
+            memory: 184M
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress

manifests/dashboard/dashboard.yaml

@@ -81,7 +81,7 @@ spec:
             secretKeyRef:
               key: password
               name: dashboard-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.6@sha256:c3415e8660af553f5e18f5d90db050614c02493c0ac6260ac59442f6d9b12048
         name: oauth-proxy
         ports:
         - containerPort: 8000

manifests/devstats-viewer/devstats-viewer.yaml

@@ -31,7 +31,7 @@ spec:
         - name: docker-config
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/devstats-viewer:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/devstats-viewer:latest@sha256:ecf19a3dd9ecc16f78d0a276aa977a7a8ee17635d5ee68ea86e5ee0a2e1ebe48
         imagePullPolicy: Always
         ports:
         - containerPort: 80

manifests/feed-fetcher/feed-fetcher.yaml

@@ -29,11 +29,16 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/feed-fetcher:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/feed-fetcher:latest@sha256:fe79408673dda5c73ed05e38cac441cbbbebd264548318f1e4701751c6a32b35
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
           name: web
+        resources:
+          requests:
+            memory: 80M
+          limits:
+            memory: 80M
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress

manifests/git-sync/git-sync.yaml

@@ -78,7 +78,7 @@ spec:
         spec:
           containers:
           - name: sync
-            image: rg.fr-par.scw.cloud/averagemarcus/git-sync:latest
+            image: rg.fr-par.scw.cloud/averagemarcus/git-sync:latest@sha256:6060f0e77e324179cf6b2136a180ceecbcc64344682154b8848434fd105323e7
             imagePullPolicy: Always
             env:
             - name: GITHUB_TOKEN

manifests/gitea/gitea.yaml

@@ -43,7 +43,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: git
-        image: gitea/gitea:1.24.6
+        image: gitea/gitea:28.3.0@sha256:8967bf9deaf3c5c4adae13519436dc1b20c646ac83fe37ae810c933a1045227d
         env:
         - name: APP_NAME
           value: "Git"
@@ -67,6 +67,8 @@ spec:
           value: arc-green
         - name: ALLOWED_HOST_LIST
           value: "*"
+        - name: EGRESS_MODE
+          value: "lax"
         - name: SECRET_KEY
           valueFrom:
             secretKeyRef:
@@ -77,7 +79,7 @@ spec:
           name: web
         resources:
           requests:
-            memory: 400Mi
+            memory: 700Mi
         volumeMounts:
         - mountPath: /data
           name: git-data

manifests/goplayground/goplayground.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: x1unix/go-playground:2.5.7
+        image: x1unix/go-playground:3.0.0@sha256:4c4a9bcbc0413faaacc8eb0a425922858a55b73ab03f5359082217d5b93cc000
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 8000

manifests/grist/grist.yaml

@@ -64,6 +64,8 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: grist
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:
@@ -73,7 +75,7 @@ spec:
       priorityClassName: critical
       containers:
         - name: grist
-          image: gristlabs/grist-oss:1.7.3
+          image: gristlabs/grist-oss:1.7.22@sha256:40d2c0ce0c29b2aa1ec1dcf9652ec26a13a8f2b4b44116733bcede428afd27dc
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
@@ -98,14 +100,17 @@ spec:
               value: default
             - name: GRIST_TELEMETRY_LEVEL
               value: "off"
-            - name: ALLOWED_WEBHOOK_DOMAINS
-              value: "tank.tank.svc,matrix.cluster.fun"
             - name: GRIST_ANON_PLAYGROUND
               value: "false"
             - name: GRIST_FORCE_LOGIN
               value: "true"
             - name: GRIST_SANDBOX_FLAVOR
               value: gvisor
+          resources:
+            requests:
+              memory: 300M
+            limits:
+              memory: 600M
           securityContext:
             capabilities:
               add:

manifests/homelab-accessible-check/homelab-accessible-check.yaml

@@ -0,0 +1,53 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: docker-config
+  namespace: homelab-accessible-check
+  annotations:
+    kube-1password: i6ngbk5zf4k52xgwdwnfup5bby
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-key: .dockerconfigjson
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: e30=
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: homelab-accessible-check
+  namespace: homelab-accessible-check
+  annotations:
+    kube-1password: bz6ujxc5neqma242lpfqdxfiay
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+type: Opaque
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: homelab-accessible-check
+  namespace: homelab-accessible-check
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: homelab-accessible-check
+  template:
+    metadata:
+      labels:
+        app: homelab-accessible-check
+    spec:
+      imagePullSecrets:
+        - name: docker-config
+      containers:
+      - name: checker
+        image: rg.fr-par.scw.cloud/averagemarcus-private/homelab-accessible-check:latest
+        imagePullPolicy: Always
+        envFrom:
+        - secretRef:
+            name: "homelab-accessible-check"
+        resources:
+          limits:
+            memory: 50Mi
+          requests:
+            memory: 50Mi

manifests/link/link.yaml

@@ -35,6 +35,18 @@ data:
     cnsmunich-feedback: https://yay-or-nay.cluster.fun/feedback/20UETBI0
     containerdays25: https://speaking.marcusnoble.co.uk/HARSlE/the-future-of-kubernetes-admission-logic
     containerdays25-feedback: https://yay-or-nay.cluster.fun/feedback/F8P351QK
+    cdl-2026: https://speaking.marcusnoble.co.uk/lMcEwR/pod-deep-dive-the-interesting-bits
+    cdl-2026-feedback: https://yay-or-nay.cluster.fun/feedback/EMLARINI
+    cdl-talk-2026: https://speaking.marcusnoble.co.uk/0rRvmv/debugging-your-conference-talk-practical-tips-to-resonate-with-your-audience
+    cdl-talk-2026-feedback: https://yay-or-nay.cluster.fun/feedback/22TO05MQ
+    technical-talking-blog-post: https://marcusnoble.co.uk/2025-04-30-my-tips-on-giving-technical-talks/
+    kubecon-eu-26: https://speaking.marcusnoble.co.uk/zT471P/kube-oddities-the-quirks-that-keep-kubernetes-interesting
+    cndro26: https://speaking.marcusnoble.co.uk/1OrBAe/kube-oddities-the-quirks-that-keep-kubernetes-interesting-marcus-noble-mark-sagi-kazar
+    cdh26: https://speaking.marcusnoble.co.uk/dvat0w/kube-oddities-the-quirks-that-keep-kubernetes-interesting-marcus-noble-mark-sagi-kazar
+    kcdsofia26: https://speaking.marcusnoble.co.uk/GFJgtL/kube-oddities-the-quirks-that-keep-kubernetes-interesting-marcus-noble-mark-sagi-kazar
+    cndpoland26: https://speaking.marcusnoble.co.uk/sZ2Ulk/kube-oddities-the-quirks-that-keep-kubernetes-interesting-marcus-noble-mark-sagi-kazar
+    kcduk2026: https://speaking.marcusnoble.co.uk/Xpj6t6/pod-deep-dive-the-interesting-bits
+    kcduk2026-feedback: https://yay-or-nay.cluster.fun/feedback/BS01AM1M
 ---
 apiVersion: v1
 kind: Service
@@ -59,6 +71,8 @@ metadata:
   namespace: link
   labels:
     app: link
+  annotations:
+    secret.reloader.stakater.com/reload: "urls-map"
 spec:
   replicas: 1
   selector:
@@ -72,7 +86,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/link:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/link:latest@sha256:11d3908c87c91c3e9b0ac64377a016f967eb96d92c5a478f61ac4d6e4b7128f9
         imagePullPolicy: Always
         ports:
         - containerPort: 5050

manifests/marcusnoble/marcusnoble.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/marcusnoble:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/marcusnoble:latest@sha256:258e639003301f9a41a796c74a963b624454de6dad2dd90f0a1eb745027cfc88
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
@@ -39,16 +39,16 @@ spec:
             memory: 50Mi
           requests:
             memory: 50Mi
-        # livenessProbe:
-        #   httpGet:
-        #     path: /healthz
-        #     port: web
-        #   initialDelaySeconds: 10
-        # readinessProbe:
-        #   httpGet:
-        #     path: /healthz
-        #     port: web
-        #   initialDelaySeconds: 10
+        livenessProbe:
+          httpGet:
+            path: /
+            port: web
+          initialDelaySeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /
+            port: web
+          initialDelaySeconds: 10
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress

manifests/mastodon-digest/mastodon_digest.yaml

@@ -1,230 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: docker-config
-  namespace: mastodon-digest
-  annotations:
-    kube-1password: i6ngbk5zf4k52xgwdwnfup5bby
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-key: .dockerconfigjson
-type: kubernetes.io/dockerconfigjson
-data:
-  .dockerconfigjson: e30=
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: mastodon-digest-auth
-  namespace: mastodon-digest
-  annotations:
-    kube-1password: mr6spkkx7n3memkbute6ojaarm
-    kube-1password/vault: Kubernetes
-type: Opaque
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: mastodon-digest
-  namespace: mastodon-digest
-  annotations:
-    kube-1password: bfklz3yi3dn4e7xtsbttcvhata
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-parse: "true"
-type: Opaque
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: config
-  namespace: mastodon-digest
-  labels:
-    app: mastodon-digest
-data:
-  config.json: |
-    [
-      {
-        "timeline": "home",
-        "hours": 12,
-        "scorer": "ExtendedSimpleWeighted",
-        "threshold": "lax",
-        "output": "/usr/share/nginx/html/home/"
-      },
-      {
-        "timeline": "federated",
-        "hours": 12,
-        "scorer": "ExtendedSimpleWeighted",
-        "threshold": "lax",
-        "output": "/usr/share/nginx/html/federated/"
-      }
-    ]
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: index
-  namespace: mastodon-digest
-  labels:
-    app: mastodon-digest
-data:
-  index.html: |
-    <!DOCTYPE html>
-    <html lang="en">
-    <head>
-        <meta chartset="utf-8" />
-        <meta name="viewport" content="width=device-width, initial-scale=1" />
-        <title>Mastodon Digest</title>
-        <style>
-        body { background-color: #292c36; font-family: "Arial", sans-serif; }
-        div#container { margin: auto; max-width: 640px; padding: 10px; text-align: center; margin: 0 auto; }
-        .links { align: center; }
-        h1 { color: white; }
-        a.button { background: #595aff; color: #fff; line-height: 1.2; min-height: 38px; min-width: 88px; padding: 0 30px; border: 0; border-radius: 6px;; display: inline-flex; justify-content: center; align-items: center; }
-    </style>
-    </head>
-    <body>
-        <div id="container">
-            <h1>Mastodon Digest</h1>
-            <section class="links">
-                <a href="home/" class="button">Home</a>
-                <a href="federated/" class="button">Federated</a>
-            </section>
-        </div>
-    </body>
-    </html>
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: mastodon-digest
-  namespace: mastodon-digest
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    targetPort: auth
-    name: web
-  selector:
-    app: mastodon-digest
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mastodon-digest
-  namespace: mastodon-digest
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: mastodon-digest
-  template:
-    metadata:
-      labels:
-        app: mastodon-digest
-    spec:
-      imagePullSecrets:
-        - name: docker-config
-      priorityClassName: low
-      containers:
-      - args:
-        - --cookie-secure=false
-        - --provider=oidc
-        - --provider-display-name=Auth0
-        - --upstream=http://localhost:80
-        - --http-address=$(HOST_IP):8000
-        - --redirect-url=https://mastodon-digest.cluster.fun/oauth2/callback
-        - --email-domain=marcusnoble.co.uk
-        - --pass-basic-auth=false
-        - --pass-access-token=false
-        - --oidc-issuer-url=https://marcusnoble.eu.auth0.com/
-        - --cookie-secret=KDGD6rrK6cBmryyZ4wcJ9xAUNW9AQNFT
-        env:
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: status.podIP
-        - name: OAUTH2_PROXY_CLIENT_ID
-          valueFrom:
-            secretKeyRef:
-              key: username
-              name: mastodon-digest-auth
-        - name: OAUTH2_PROXY_CLIENT_SECRET
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: mastodon-digest-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
-        name: oauth-proxy
-        ports:
-        - containerPort: 8000
-          protocol: TCP
-          name: auth
-        resources:
-          limits:
-            memory: 50Mi
-          requests:
-            memory: 50Mi
-
-      - name: web
-        image: nginx:stable
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 80
-          name: web
-        volumeMounts:
-        - name: html
-          mountPath: /usr/share/nginx/html
-        - name: index
-          mountPath: /usr/share/nginx/html/index.html
-          subPath: index.html
-
-      - name: digest
-        image: rg.fr-par.scw.cloud/averagemarcus-private/mastodon-digest:latest
-        imagePullPolicy: Always
-        env:
-        - name: CONFIG_FILE
-          value: /config.json
-        envFrom:
-        - secretRef:
-            name: mastodon-digest
-        volumeMounts:
-        - name: config
-          mountPath: /config.json
-          subPath: config.json
-        - name: html
-          mountPath: /usr/share/nginx/html
-      volumes:
-      - name: html
-        emptyDir: {}
-      - name: config
-        configMap:
-          name: config
-      - name: index
-        configMap:
-          name: index
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: mastodon-digest
-  namespace: mastodon-digest
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - mastodon-digest.cluster.fun
-    secretName: mastodon-digest-ingress
-  rules:
-  - host: mastodon-digest.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: mastodon-digest
-            port:
-              number: 80

manifests/mazanoke/manifest.yaml

@@ -0,0 +1,69 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mazanoke
+  namespace: mazanoke
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: mazanoke
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mazanoke
+  namespace: mazanoke
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mazanoke
+  template:
+    metadata:
+      labels:
+        app: mazanoke
+    spec:
+      containers:
+      - name: web
+        image: ghcr.io/civilblur/mazanoke:v1.1.7@sha256:ca83cddd90cd1e4b43102884bf39025731a1c7569f3bbda9d6530de72528cbab
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 80
+          name: web
+        resources:
+          limits:
+            memory: 200Mi
+          requests:
+            memory: 200Mi
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: mazanoke
+  namespace: mazanoke
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - image.cluster.fun
+    secretName: mazanoke-ingress
+  rules:
+  - host: image.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: mazanoke
+            port:
+              number: 80
+

manifests/mealie/mealie.yaml

@@ -31,7 +31,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: frontend
-        image: ghcr.io/mealie-recipes/mealie:v3.2.1
+        image: ghcr.io/mealie-recipes/mealie:v3.30.0@sha256:90f83da6f3ab0a421efc827118a556168573930105f13fa3321768f42163d784
         imagePullPolicy: Always
         envFrom:
         - secretRef:
@@ -72,10 +72,10 @@ spec:
         resources:
           requests:
             cpu: 200m
-            memory: 443M
+            memory: 375Mi
           limits:
             cpu: 1000m
-            memory: 443M
+            memory: 550Mi
       volumes:
       - name: data
         persistentVolumeClaim:

manifests/monitoring/cadvisor.yaml

@@ -0,0 +1,87 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: cadvisor
+    app.kubernetes.io/name: cadvisor
+  name: cadvisor
+  namespace: monitoring
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  annotations:
+    seccomp.security.alpha.kubernetes.io/pod: docker/default
+  labels:
+    app: cadvisor
+    app.kubernetes.io/name: cadvisor
+  name: cadvisor
+  namespace: monitoring
+spec:
+  selector:
+    matchLabels:
+      app: cadvisor
+      app.kubernetes.io/name: cadvisor
+      name: cadvisor
+  template:
+    metadata:
+      labels:
+        app: cadvisor
+        app.kubernetes.io/name: cadvisor
+        name: cadvisor
+      annotations:
+        scheduler.alpha.kubernetes.io/critical-pod: ''
+    spec:
+      priorityClassName: system-node-critical
+      tolerations:
+        - key: "CriticalAddonsOnly"
+          operator: "Exists"
+      automountServiceAccountToken: false
+      containers:
+      - image: ghcr.io/google/cadvisor:v0.60.6@sha256:b8e7d1093144fd088f425ff003d75a4aa405de075db78dae3bc563730b1bd07a
+        name: cadvisor
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        resources:
+          limits:
+            cpu: 800m
+            memory: 800Mi
+          requests:
+            cpu: 400m
+            memory: 400Mi
+        volumeMounts:
+        - mountPath: /rootfs
+          name: rootfs
+          readOnly: true
+        - mountPath: /var/run
+          name: var-run
+          readOnly: true
+        - mountPath: /sys
+          name: sys
+          readOnly: true
+        - mountPath: /var/lib/docker
+          name: docker
+          readOnly: true
+        - mountPath: /dev/disk
+          name: disk
+          readOnly: true
+      serviceAccountName: cadvisor
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - hostPath:
+          path: /
+        name: rootfs
+      - hostPath:
+          path: /var/run
+        name: var-run
+      - hostPath:
+          path: /sys
+        name: sys
+      - hostPath:
+          path: /var/lib/docker
+        name: docker
+      - hostPath:
+          path: /dev/disk
+        name: disk

manifests/monitoring/ephemeral-storage-exporter.yaml

@@ -0,0 +1,142 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/name: k8s-ephemeral-storage-metrics
+  name: k8s-ephemeral-storage-metrics
+  namespace: monitoring
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: k8s-ephemeral-storage-metrics
+  labels:
+    app.kubernetes.io/name: k8s-ephemeral-storage-metrics
+rules:
+  - apiGroups: [""]
+    resources: ["nodes","nodes/proxy", "nodes/stats", "pods"]
+    verbs: ["get","list", "watch"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: k8s-ephemeral-storage-metrics
+  labels:
+    app.kubernetes.io/name: k8s-ephemeral-storage-metrics
+subjects:
+  - kind: ServiceAccount
+    name: k8s-ephemeral-storage-metrics
+    namespace: monitoring
+roleRef:
+  kind: ClusterRole
+  name: k8s-ephemeral-storage-metrics
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: k8s-ephemeral-storage-metrics
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/name: k8s-ephemeral-storage-metrics
+  annotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "9100"
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: k8s-ephemeral-storage-metrics
+  ports:
+    - name: metrics
+      port: 9100
+      protocol: TCP
+      targetPort: metrics
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: k8s-ephemeral-storage-metrics
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/name: k8s-ephemeral-storage-metrics
+spec:
+  replicas: 1
+  revisionHistoryLimit: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: k8s-ephemeral-storage-metrics
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: k8s-ephemeral-storage-metrics
+    spec:
+      serviceAccountName: k8s-ephemeral-storage-metrics
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: metrics
+          image: ghcr.io/jmcgrath207/k8s-ephemeral-storage-metrics:1.21.3@sha256:8297aa4a92787ebda42827be98da6f7a77206f4c8d140858626c97c469997b67
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: metrics
+              containerPort: 9100
+              protocol: TCP
+          livenessProbe:
+            failureThreshold: 10
+            httpGet:
+              path: /metrics
+              port: 9100
+              scheme: HTTP
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 30
+          readinessProbe:
+            failureThreshold: 10
+            httpGet:
+              path: /metrics
+              port: 9100
+              scheme: HTTP
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 1
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            privileged: false
+            readOnlyRootFilesystem: false
+            runAsNonRoot: true
+          env:
+            - name: DEPLOY_TYPE
+              value: "Deployment"
+            - name: SCRAPE_INTERVAL
+              value: "15"
+            - name: MAX_NODE_CONCURRENCY
+              value: "10"
+            - name: CLIENT_GO_QPS
+              value: "5"
+            - name: CLIENT_GO_BURST
+              value: "10"
+            - name: LOG_LEVEL
+              value: "info"
+            - name: EPHEMERAL_STORAGE_POD_USAGE
+              value: "true"
+            - name: EPHEMERAL_STORAGE_NODE_AVAILABLE
+              value: "true"
+            - name: EPHEMERAL_STORAGE_NODE_CAPACITY
+              value: "true"
+            - name: EPHEMERAL_STORAGE_NODE_PERCENTAGE
+              value: "true"
+            - name: EPHEMERAL_STORAGE_CONTAINER_LIMIT_PERCENTAGE
+              value: "true"
+            - name: EPHEMERAL_STORAGE_CONTAINER_VOLUME_USAGE
+              value: "true"
+            - name: EPHEMERAL_STORAGE_CONTAINER_VOLUME_LIMITS_PERCENTAGE
+              value: "true"
+            - name: EPHEMERAL_STORAGE_INODES
+              value: "true"

manifests/monitoring/kube-state-metrics.yaml

@@ -201,6 +201,7 @@ spec:
       labels:
         app.kubernetes.io/name: kube-state-metrics
     spec:
+      priorityClassName: system-cluster-critical
       serviceAccountName: kube-state-metrics
       securityContext:
         fsGroup: 65534
@@ -237,7 +238,7 @@ spec:
         - --resources=validatingwebhookconfigurations
         #- --resources=volumeattachments
         imagePullPolicy: IfNotPresent
-        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0"
+        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0@sha256:42cfe3723a5f058171c627537fb57a3ea0f26e4380fa18555a95cb1a1b4cfc5b"
         ports:
         - containerPort: 8080
         livenessProbe:

manifests/monitoring/node-exporter.yaml

@@ -51,10 +51,11 @@ spec:
         app.kubernetes.io/name: prometheus
         app.kubernetes.io/component: node-exporter
     spec:
+      priorityClassName: system-node-critical
       serviceAccountName: prometheus-node-exporter
       containers:
         - name: prometheus-node-exporter
-          image: "prom/node-exporter:v1.9.1"
+          image: "prom/node-exporter:v1.12.1@sha256:1b4e4438faca4dd7e001dd445d161a4a2091b0fededa84093b3a8dfeae1f1be0"
           imagePullPolicy: "IfNotPresent"
           args:
             - --path.procfs=/host/proc

manifests/monitoring/promtail.yaml

@@ -212,10 +212,11 @@ spec:
         prometheus.io/port: http-metrics
         prometheus.io/scrape: "true"
     spec:
+      priorityClassName: system-node-critical
       serviceAccountName: promtail
       containers:
         - name: promtail
-          image: "grafana/promtail:2.9.15"
+          image: "grafana/promtail:2.9.17@sha256:b28495fdab552b183428c5b5cebbf258231fc5f00be7724be2bc091ad21ac390"
           imagePullPolicy: IfNotPresent
           args:
             - "-config.file=/etc/promtail/promtail.yaml"

manifests/monitoring/vmagent.yaml

@@ -17,6 +17,11 @@ data:
     - job_name: 'vmagent'
       static_configs:
         - targets: ['localhost:8429']
+      relabel_configs:
+      - action: drop
+        source_labels: [__name__]
+        regex: "flag"
+
     - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
       job_name: kubernetes-nodes
       kubernetes_sd_configs:
@@ -36,6 +41,38 @@ data:
         ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
         insecure_skip_verify: true
 
+    - job_name: cadvisor
+      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+      scheme: https
+      tls_config:
+        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+        insecure_skip_verify: true
+      kubernetes_sd_configs:
+      - role: node
+      relabel_configs:
+      - action: labelmap
+        regex: __meta_kubernetes_node_label_(.+)
+      - replacement: kubernetes.default.svc:443
+        target_label: __address__
+      - source_labels: [__meta_kubernetes_node_name]
+        regex: (.+)
+        target_label: __metrics_path__
+        replacement: /api/v1/nodes/$1/proxy/metrics/cadvisor
+      # Drop high cardinality labels
+      - action: labeldrop
+        regex: id
+      # Drop unneeded labels
+      - action: labeldrop
+        regex: beta_kubernetes_io_os
+      - action: labeldrop
+        regex: beta_kubernetes_io_arch
+      - action: labeldrop
+        regex: kubernetes_io_arch
+      - action: labeldrop
+        regex: kubernetes_io_os
+      - action: labeldrop
+        regex: topology_jiva_openebs_io_nodeName
+
     - job_name: kubernetes-service-endpoints
       kubernetes_sd_configs:
       - role: endpoints
@@ -78,6 +115,21 @@ data:
         source_labels:
         - __meta_kubernetes_pod_node_name
         target_label: kubernetes_node
+      # We don't care about the flag metrics from VM
+      - action: drop
+        source_labels: [__name__]
+        regex: "flag"
+      # Drop unneeded labels
+      - action: labeldrop
+        regex: beta_kubernetes_io_os
+      - action: labeldrop
+        regex: beta_kubernetes_io_arch
+      - action: labeldrop
+        regex: kubernetes_io_arch
+      - action: labeldrop
+        regex: kubernetes_io_os
+      - action: labeldrop
+        regex: topology_jiva_openebs_io_nodeName
 
     - job_name: kubernetes-pods
       kubernetes_sd_configs:
@@ -116,6 +168,17 @@ data:
         regex: Pending|Succeeded|Failed
         source_labels:
         - __meta_kubernetes_pod_phase
+      # Drop unneeded labels
+      - action: labeldrop
+        regex: beta_kubernetes_io_os
+      - action: labeldrop
+        regex: beta_kubernetes_io_arch
+      - action: labeldrop
+        regex: kubernetes_io_arch
+      - action: labeldrop
+        regex: kubernetes_io_os
+      - action: labeldrop
+        regex: topology_jiva_openebs_io_nodeName
 
     - job_name: 'node-exporter'
       kubernetes_sd_configs:
@@ -150,10 +213,11 @@ spec:
         app.kubernetes.io/name: victoria-metrics
         app.kubernetes.io/component: agent
     spec:
+      priorityClassName: system-cluster-critical
       serviceAccountName: prometheus-server
       containers:
         - name: vmagent
-          image: "victoriametrics/vmagent:v1.126.0"
+          image: "victoriametrics/vmagent:v1.155.0@sha256:8e3c03905be15bba8312d4868e8ae6f9fc2fefee0a41d544472034249ca42bb4"
           imagePullPolicy: "IfNotPresent"
           args:
             - -remoteWrite.url=http://vmcluster.auth-proxy.svc/insert/0/prometheus/

manifests/nextcloud_chart/manifest.yaml

@@ -56,7 +56,9 @@ data:
   general.config.php: |-
     <?php
     $CONFIG = array (
-        'overwriteprotocol' => 'https'
+        'overwriteprotocol' => 'https',
+        'loglevel' => 1,
+        'log_rotate_size' => 100 * 1024 * 1024
     );
   .htaccess: |-
     # line below if for Apache 2.4
@@ -204,7 +206,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: nextcloud
-        image: "nextcloud:31.0.9-apache"
+        image: "nextcloud:35.0.2-apache@sha256:786c102155d2717ba0f53a62b3fdd7a1354edc48e800b94dbe32294d9a5752a2"
         imagePullPolicy: IfNotPresent
         env:
         - name: SQLITE_DATABASE
@@ -284,9 +286,101 @@ spec:
         resources:
           requests:
             cpu: 1038m
-            memory: 512M
+            memory: 500M
           limits:
             cpu: 1200m
+            memory: 765M
+        volumeMounts:
+        - name: nextcloud-data
+          mountPath: /var/www/
+          subPath: root
+        - name: nextcloud-data
+          mountPath: /var/www/html
+          subPath: html
+        - name: nextcloud-data
+          mountPath: /var/www/html/data
+          subPath: data
+        - name: nextcloud-data
+          mountPath: /var/www/html/config
+          subPath: config
+        - name: nextcloud-data
+          mountPath: /var/www/html/custom_apps
+          subPath: custom_apps
+        - name: nextcloud-data
+          mountPath: /var/www/tmp
+          subPath: tmp
+        - name: nextcloud-data
+          mountPath: /var/www/html/themes
+          subPath: themes
+        - name: nextcloud-config
+          mountPath: /var/www/html/config/general.config.php
+          subPath: general.config.php
+        - name: nextcloud-s3
+          mountPath: /var/www/html/config/s3.config.php
+          subPath: s3.config.php
+        - name: nextcloud-config
+          mountPath: /var/www/html/config/.htaccess
+          subPath: .htaccess
+        - name: nextcloud-config
+          mountPath: /var/www/html/config/apache-pretty-urls.config.php
+          subPath: apache-pretty-urls.config.php
+        - name: nextcloud-config
+          mountPath: /var/www/html/config/apcu.config.php
+          subPath: apcu.config.php
+        - name: nextcloud-config
+          mountPath: /var/www/html/config/apps.config.php
+          subPath: apps.config.php
+        - name: nextcloud-config
+          mountPath: /var/www/html/config/autoconfig.php
+          subPath: autoconfig.php
+        - name: nextcloud-config
+          mountPath: /var/www/html/config/redis.config.php
+          subPath: redis.config.php
+        - name: nextcloud-config
+          mountPath: /var/www/html/config/smtp.config.php
+          subPath: smtp.config.php
+      - name: cron
+        image: "nextcloud:35.0.2-apache@sha256:786c102155d2717ba0f53a62b3fdd7a1354edc48e800b94dbe32294d9a5752a2"
+        imagePullPolicy: IfNotPresent
+        command:
+          - /cron.sh
+        env:
+          - name: SQLITE_DATABASE
+            value: "nextcloud"
+          - name: NEXTCLOUD_ADMIN_USER
+            valueFrom:
+              secretKeyRef:
+                name: nextcloud-nextcloud
+                key: nextcloud-username
+          - name: NEXTCLOUD_ADMIN_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: nextcloud-nextcloud
+                key: nextcloud-password
+          - name: NEXTCLOUD_TRUSTED_DOMAINS
+            value: nextcloud.cluster.fun
+          - name: NEXTCLOUD_DATA_DIR
+            value: "/var/www/html/data"
+          - name: REDIS_HOST
+            valueFrom:
+              secretKeyRef:
+                name: nextcloud-nextcloud-redis
+                key: redis-host
+          - name: REDIS_PORT
+            valueFrom:
+              secretKeyRef:
+                name: nextcloud-nextcloud-redis
+                key: redis-port
+          - name: REDIS_HOST_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: nextcloud-nextcloud-redis
+                key: redis-password
+          - name: REDIS_DB_INDEX
+            valueFrom:
+              secretKeyRef:
+                name: nextcloud-nextcloud-redis
+                key: redis-db-index
         volumeMounts:
         - name: nextcloud-data
           mountPath: /var/www/
@@ -350,45 +444,6 @@ spec:
       securityContext:
         fsGroup: 33
 ---
-# Source: nextcloud/templates/cronjob.yaml
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: nextcloud-nextcloud-cron
-  labels:
-    app.kubernetes.io/name: nextcloud
-    app.kubernetes.io/instance: nextcloud-nextcloud
-  annotations:
-    {}
-spec:
-  schedule: "*/5 * * * *"
-  concurrencyPolicy: Forbid
-  failedJobsHistoryLimit: 5
-  successfulJobsHistoryLimit: 2
-  jobTemplate:
-    metadata:
-      labels:
-        app.kubernetes.io/name: nextcloud
-    spec:
-      template:
-        metadata:
-          labels:
-            app.kubernetes.io/name: nextcloud
-        spec:
-          restartPolicy: Never
-          containers:
-            - name: nextcloud
-              image: "nextcloud:31.0.9-apache"
-              imagePullPolicy: IfNotPresent
-              command: [ "curl" ]
-              args:
-                - "--fail"
-                - "-L"
-                - "https://nextcloud.cluster.fun/cron.php"
-              resources:
-                requests:
-                  memory: 200Mi
----
 # Source: nextcloud/templates/ingress.yaml
 apiVersion: networking.k8s.io/v1
 kind: Ingress

manifests/nginx-lb/nginx-lb.yaml

@@ -492,7 +492,7 @@ spec:
               fieldPath: metadata.namespace
         - name: LD_PRELOAD
           value: /usr/local/lib/libmimalloc.so
-        image: registry.k8s.io/ingress-nginx/controller:v1.13.2@sha256:1f7eaeb01933e719c8a9f4acd8181e555e582330c7d50f24484fb64d2ba9b2ef
+        image: registry.k8s.io/ingress-nginx/controller:v1.15.1@sha256:594ceea76b01c592858f803f9ff4d2cb40542cae2060410b2c95f75907d659e1
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:

manifests/nodered/nodered.yaml

@@ -57,7 +57,7 @@ spec:
           - name: data
             mountPath: /data
       - name: update-native-modules
-        image: nodered/node-red:4.1.0-18
+        image: nodered/node-red:4.1.17-18@sha256:161239fa8c3ebc2e6c5c831eb536960d4bdec677c7117a738d89a106cc2755a6
         imagePullPolicy: IfNotPresent
         command:
           - bash
@@ -73,11 +73,16 @@ spec:
             mountPath: /data
       containers:
       - name: web
-        image: nodered/node-red:4.1.0-18
+        image: nodered/node-red:4.1.17-18@sha256:161239fa8c3ebc2e6c5c831eb536960d4bdec677c7117a738d89a106cc2755a6
         imagePullPolicy: Always
         ports:
         - containerPort: 1880
           name: web
+        resources:
+          requests:
+            memory: 200M
+          limits:
+            memory: 200M
         volumeMounts:
           - name: data
             mountPath: /data

manifests/opengraph/opengraph.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/opengraph-image-gen:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/opengraph-image-gen:latest@sha256:97aea61e4db1e6d441fdfecd28f614b1e5342bfacd3a5ca6021ffca5c03db833
         imagePullPolicy: Always
         ports:
         - containerPort: 3000

manifests/outline/outline.yaml

@@ -46,7 +46,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: outline
-        image: outlinewiki/outline:0.87.4
+        image: outlinewiki/outline:1.12.0@sha256:25d6a2ced2f1f0cf03c09abd776d87ba31941ed96d3a99992aa84b3bd0afc074
         imagePullPolicy: IfNotPresent
         env:
         - name: ALLOWED_DOMAINS
@@ -73,7 +73,9 @@ spec:
         resources:
           requests:
             cpu: 8m
-            memory: 1024Mi
+            memory: 900Mi
+          limits:
+            memory: 1489Mi
         volumeMounts:
           - mountPath: /opt/outline/.env
             subPath: .env

manifests/pairdrop/pairdrop.yaml

@@ -0,0 +1,88 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: pairdrop
+  namespace: pairdrop
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: pairdrop
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pairdrop
+  namespace: pairdrop
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: pairdrop
+  template:
+    metadata:
+      labels:
+        app: pairdrop
+    spec:
+      imagePullSecrets:
+        - name: docker-config
+      priorityClassName: low
+      containers:
+      - name: web
+        image: ghcr.io/schlagmichdoch/pairdrop:v1.11.2@sha256:c4b30977264a76e335740089e693a52a0d0d616330dec7f93c7b96beef7b4a02
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 3000
+          name: web
+        env:
+        - name: RATE_LIMIT
+          value: "1"
+        - name: DONATION_BUTTON_ACTIVE
+          value: "false"
+        - name: TWITTER_BUTTON_ACTIVE
+          value: "false"
+        - name: MASTODON_BUTTON_ACTIVE
+          value: "false"
+        - name: BLUESKY_BUTTON_ACTIVE
+          value: "false"
+        - name: PRIVACYPOLICY_BUTTON_ACTIVE
+          value: "false"
+        resources:
+          limits:
+            memory: 100Mi
+          requests:
+            memory: 100Mi
+        livenessProbe:
+          httpGet:
+            path: /
+            port: web
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: pairdrop
+  namespace: pairdrop
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - drop.cluster.fun
+    secretName: pairdrop-ingress
+  rules:
+  - host: drop.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: pairdrop
+            port:
+              number: 80

manifests/planning-poker/planning-poker.yaml

@@ -0,0 +1,111 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: planning-poker
+  namespace: planning-poker
+  labels:
+    app.kubernetes.io/name: planning-poker
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: planning-poker-data
+  namespace: planning-poker
+  labels:
+    app.kubernetes.io/name: planning-poker
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "1Gi"
+  storageClassName: "sbs-default-retain"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: planning-poker
+  namespace: planning-poker
+  labels:
+    app.kubernetes.io/name: planning-poker
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: web
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: planning-poker
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: planning-poker
+  namespace: planning-poker
+  labels:
+    app.kubernetes.io/name: planning-poker
+  annotations:
+    secret.reloader.stakater.com/reload: "planning-poker"
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: planning-poker
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: planning-poker
+    spec:
+      serviceAccountName: planning-poker
+      priorityClassName: critical
+      containers:
+        - name: planning-poker
+          image: ghcr.io/axeleroy/self-host-planning-poker:1.2.1@sha256:0253f17c07f6c484b6fbef65867863541494e063355d39757ca27963404864d4
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: web
+              containerPort: 8000
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: web
+          readinessProbe:
+            tcpSocket:
+              port: web
+          volumeMounts:
+            - name: data
+              mountPath: /data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: planning-poker-data
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: planning-poker
+  namespace: planning-poker
+  labels:
+    app.kubernetes.io/name: planning-poker
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - planning-poker.cluster.fun
+    secretName: planning-poker-ingress
+  rules:
+    - host: "planning-poker.cluster.fun"
+      http:
+        paths:
+          - path: /
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: planning-poker
+                port:
+                  number: 80

manifests/qr/qr.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/qr:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/qr:latest@sha256:e98db60ab26d5769bc5b17384fcb10d98e71b353fc23d154d5049fd88bab00eb
         imagePullPolicy: Always
         ports:
         - containerPort: 8080

manifests/redis/redis.yaml

@@ -330,7 +330,7 @@ spec:
       priorityClassName: critical
       containers:
         - name: redis
-          image: docker.io/bitnamilegacy/redis:7.2.4-debian-11-r11
+          image: docker.io/bitnamilegacy/redis:7.2.4-debian-11-r11@sha256:c81b0644726b22fa65669b427610701e86dceb0007438f5d75d271b3197a48bf
           imagePullPolicy: "IfNotPresent"
           securityContext:
             runAsUser: 1001
@@ -472,7 +472,7 @@ spec:
       terminationGracePeriodSeconds: 30
       containers:
         - name: redis
-          image: docker.io/bitnamilegacy/redis:7.2.4-debian-11-r11
+          image: docker.io/bitnamilegacy/redis:7.2.4-debian-11-r11@sha256:c81b0644726b22fa65669b427610701e86dceb0007438f5d75d271b3197a48bf
           imagePullPolicy: "IfNotPresent"
           securityContext:
             runAsUser: 1001

manifests/rss/miniflux.yaml

@@ -68,7 +68,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: ghcr.io/miniflux/miniflux:2.2.12
+        image: ghcr.io/miniflux/miniflux:2.3.5@sha256:8fd6c3c434ecc3d4083306f83e03c0bb74c632e0f8378da5ead7e1773b0b89c9
         imagePullPolicy: IfNotPresent
         envFrom:
         - configMapRef:

manifests/social-to-rolodex/social-to-rolodex.yaml

@@ -92,7 +92,7 @@ spec:
             secretKeyRef:
               key: password
               name: social-to-rolodex-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.6@sha256:c3415e8660af553f5e18f5d90db050614c02493c0ac6260ac59442f6d9b12048
         name: oauth-proxy
         ports:
         - containerPort: 8000

manifests/sre-agent/sre-agent.yaml

@@ -0,0 +1,131 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sre-agent
+  namespace: default
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: sre-agent
+  namespace: default
+  annotations:
+    kubernetes.io/service-account.name: sre-agent
+type: kubernetes.io/service-account-token
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: sre-agent
+  labels:
+    app.kubernetes.io/name: sre-agent
+rules:
+  # Node-level diagnostics
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["nodes/proxy", "nodes/metrics", "nodes/stats"]
+    verbs: ["get", "list"]
+
+  # Pod diagnostics
+  - apiGroups: [""]
+    resources: ["pods", "pods/log", "pods/status", "pods/ephemeralcontainers"]
+    verbs: ["get", "list", "watch"]
+
+  # Services, endpoints, networking
+  - apiGroups: [""]
+    resources: ["services", "endpoints", "endpointslices", "namespaces"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims", "persistentvolumes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["configmaps", "secrets"]
+    verbs: ["get", "list"]    # readable only, no modify/delete
+  - apiGroups: [""]
+    resources: ["resourcequotas", "limitranges"]
+    verbs: ["get", "list"]
+
+  # Network policies
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  # Workloads
+  - apiGroups: ["apps"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments/scale", "replicasets/scale"]
+    verbs: ["get"]
+
+  # Jobs & cronjobs
+  - apiGroups: ["batch"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["batch"]
+    resources: ["jobs/log"]
+    verbs: ["get", "list"]
+
+  # Autoscaling
+  - apiGroups: ["autoscaling"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  # RBAC visibility (diagnose who owns what)
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  # Custom Resource Definitions (so we can inspect custom resources)
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
+
+  # Priority classes
+  - apiGroups: ["scheduling.k8s.io"]
+    resources: ["priorityclasses"]
+    verbs: ["get", "list"]
+
+  # Certificate rotation
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["certificatesigningrequests", "certificatesigningrequests/approval"]
+    verbs: ["get", "list", "watch"]
+
+  # Metrics Server (if installed)
+  - apiGroups: ["metrics.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list"]
+
+  # Admission controllers / pod security (diagnostic)
+  - apiGroups: ["policy"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: sre-agent-binding
+  labels:
+    app.kubernetes.io/name: sre-agent
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: sre-agent
+subjects:
+  - kind: ServiceAccount
+    name: sre-agent
+    namespace: default

manifests/svg-to-dxf/svg-to-dxf.yaml

@@ -30,7 +30,7 @@ spec:
       priorityClassName: low
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/svg-to-dxf:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/svg-to-dxf:latest@sha256:7e74cd6569ed68d46b012ffbd672be9e4c6422b28fb13eb5d83b2c1dc85e9cb9
         imagePullPolicy: Always
         ports:
         - containerPort: 8080

manifests/tank/tank.yaml

@@ -1,57 +0,0 @@
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: tank
-  namespace: tank
-  annotations:
-    kube-1password: g6xle67quzowvvekf6zukjbbm4
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-parse: "true"
-type: Opaque
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: tank
-  namespace: tank
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    targetPort: web
-  selector:
-    app: tank
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tank
-  namespace: tank
-  labels:
-    app: tank
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: tank
-  template:
-    metadata:
-      labels:
-        app: tank
-    spec:
-      containers:
-      - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/tank:latest
-        imagePullPolicy: Always
-        envFrom:
-          - secretRef:
-              name: tank
-        ports:
-        - containerPort: 3000
-          name: web
-        resources:
-          limits:
-            memory: 10Mi
-          requests:
-            memory: 10Mi

manifests/text-to-dxf/text-to-dxf.yaml

@@ -30,7 +30,7 @@ spec:
       priorityClassName: low
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/text-to-dxf:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/text-to-dxf:latest@sha256:f1ce90feec0dae575979c7fa83b855ced939efe23d749cc2615f5d43a08cacb0
         imagePullPolicy: Always
         ports:
         - containerPort: 8080

manifests/traefik/traefik.yaml

@@ -45,7 +45,7 @@ spec:
         - --entrypoints.websecure.http.tls=true
         - --entrypoints.web.http.redirections.entrypoint.to=websecure
         - --entrypoints.web.http.redirections.entrypoint.scheme=https
-        image: rancher/mirrored-library-traefik:2.11.29
+        image: rancher/mirrored-library-traefik:2.11.50@sha256:e4cf36c7f13f76ad750720a8b51e9d2458964961b50a0148a806d589b5cfa88b
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3

manifests/trek/pvs.yaml

@@ -0,0 +1,26 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: trek-data
+  namespace: trek
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+  storageClassName: sbs-default-retain
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: trek-uploads
+  namespace: trek
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+  storageClassName: sbs-default-retain
+---

manifests/trek/trek.yaml

@@ -0,0 +1,157 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: trek
+  namespace: trek
+  labels:
+    app: trek
+    app.kubernetes.io/name: trek
+  annotations:
+    kube-1password: irpjqi7ppvbvldfni7ywgorpgi
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+type: Opaque
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trek
+  namespace: trek
+  labels:
+    app: trek
+    app.kubernetes.io/name: trek
+  annotations:
+    reloader.stakater.com/match: "true"
+data:
+  NODE_ENV: "production"
+  PORT: "3000"
+  TZ: "UTC"
+  LOG_LEVEL: "info"
+  DEFAULT_LANGUAGE: "en"
+  ALLOWED_ORIGINS: "https://trek.cluster.fun"
+  APP_URL: "https://trek.cluster.fun"
+  FORCE_HTTPS: "false"
+  COOKIE_SECURE: "true"
+
+---
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: trek
+  namespace: trek
+  labels:
+    app: trek
+    app.kubernetes.io/name: trek
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: trek
+  template:
+    metadata:
+      labels:
+        app: trek
+        app.kubernetes.io/name: trek
+    spec:
+      containers:
+      - name: trek
+        image: mauriceboe/trek:5.1.1@sha256:7068cc86c0d4d5aa9b55aeffd03966f7458352bcb3e010721e3d7d6899ac60bd
+        imagePullPolicy: IfNotPresent
+        envFrom:
+        - configMapRef:
+            name: trek
+        - secretRef:
+            name: trek
+        ports:
+        - containerPort: 3000
+          name: web
+        volumeMounts:
+          - mountPath: /app/data
+            name: data
+          - mountPath: /app/uploads
+            name: uploads
+        livenessProbe:
+          httpGet:
+            path: /api/health
+            port: 3000
+          initialDelaySeconds: 5
+          periodSeconds: 30
+        readinessProbe:
+          httpGet:
+            path: /api/health
+            port: 3000
+          initialDelaySeconds: 5
+          periodSeconds: 10
+        resources:
+          requests:
+            cpu: 300m
+            memory: 400Mi
+          limits:
+            cpu: 700m
+            memory: 800Mi
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: trek-data
+      - name: uploads
+        persistentVolumeClaim:
+          claimName: trek-uploads
+
+---
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: trek
+  namespace: trek
+  labels:
+    app: trek
+    app.kubernetes.io/name: trek
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: trek
+---
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: trek
+  namespace: trek
+  labels:
+    app: trek
+    app.kubernetes.io/name: trek
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/client-body-buffer-size: 25m
+    nginx.ingress.kubernetes.io/proxy-connect-timeout: "300"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
+    nginx.ingress.kubernetes.io/proxy-next-upstream: "300"
+    nginx.ingress.kubernetes.io/proxy-next-upstream-timeout: "300"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - trek.cluster.fun
+    secretName: trek-ingress
+  rules:
+  - host: trek.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: trek
+            port:
+              name: web

manifests/url-to-grist/url-to-grist.yaml

@@ -0,0 +1,117 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: url-to-grist
+  namespace: cloudnative-now
+  annotations:
+    kube-1password: bu4lczquzosu3yxhyrzbtepply
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+  labels:
+    app.kubernetes.io/name: url-to-grist
+    app.kubernetes.io/part-of: cloudnative.now
+type: Opaque
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: url-to-grist
+  labels:
+    app.kubernetes.io/name: url-to-grist
+    app.kubernetes.io/part-of: cloudnative.now
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app.kubernetes.io/name: url-to-grist
+    app.kubernetes.io/part-of: cloudnative.now
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: url-to-grist
+  labels:
+    app.kubernetes.io/name: url-to-grist
+    app.kubernetes.io/part-of: cloudnative.now
+  annotations:
+    secret.reloader.stakater.com/reload: "url-to-grist"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: url-to-grist
+      app.kubernetes.io/part-of: cloudnative.now
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: url-to-grist
+        app.kubernetes.io/part-of: cloudnative.now
+    spec:
+      containers:
+      - name: url-to-grist
+        image: ghcr.io/namelessplanet/url-to-grist:v1.6.1@sha256:7912e3340b071244d7b807759608c6bc6f8e563f548485379247ef1106a82be5
+        imagePullPolicy: IfNotPresent
+        env:
+        - name: PORT
+          value: "8080"
+        envFrom:
+        - secretRef:
+            name: "url-to-grist"
+        ports:
+        - containerPort: 8080
+          name: web
+        livenessProbe:
+          httpGet:
+            port: web
+            path: /healthz
+          initialDelaySeconds: 1
+          periodSeconds: 5
+          successThreshold: 1
+          failureThreshold: 3
+          timeoutSeconds: 3
+        readinessProbe:
+          httpGet:
+            port: web
+            path: /healthz
+          initialDelaySeconds: 1
+          periodSeconds: 5
+          successThreshold: 1
+          failureThreshold: 3
+          timeoutSeconds: 3
+        resources:
+          limits:
+            memory: 20Mi
+          requests:
+            memory: 20Mi
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: url-to-grist
+  namespace: cloudnative-now
+  labels:
+    app.kubernetes.io/name: url-to-grist
+    app.kubernetes.io/part-of: cloudnative.now
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - "url-to-grist.cloudnative.now"
+      secretName: "url-to-grist-ingress"
+  rules:
+    - host: "url-to-grist.cloudnative.now"
+      http:
+        paths:
+          - path: "/"
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: url-to-grist
+                port:
+                  name: web

manifests/vert/manifest.yaml

@@ -0,0 +1,69 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: vert
+  namespace: vert
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: vert
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vert
+  namespace: vert
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vert
+  template:
+    metadata:
+      labels:
+        app: vert
+    spec:
+      containers:
+      - name: web
+        image: ghcr.io/vert-sh/vert:sha-438f91a@sha256:c604d357e44dce6020391b6bd8d20e4f5d35e3778ecf58bbccbd8fdc6792eaf4
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 80
+          name: web
+        resources:
+          limits:
+            memory: 200Mi
+          requests:
+            memory: 200Mi
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vert
+  namespace: vert
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - vert.cluster.fun
+    secretName: vert-ingress
+  rules:
+  - host: vert.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: vert
+            port:
+              number: 80
+

manifests/yay-or-nay/yay-or-nay.yaml

@@ -17,7 +17,7 @@ metadata:
     app: yay-or-nay
     app.kubernetes.io/name: yay-or-nay
   annotations:
-    reloader.stakater.com/search: "true"
+    secret.reloader.stakater.com/reload: "yay-or-nay"
 spec:
   replicas: 1
   selector:
@@ -31,7 +31,7 @@ spec:
     spec:
       containers:
       - name: yay-or-nay
-        image: ghcr.io/mocdaniel/yay-or-nay:1.1.1
+        image: ghcr.io/mocdaniel/yay-or-nay:1.2.1@sha256:3edb37642d749124e9e03a6dbaca9ae5d0a45dd9361a0dbcae1ad051faeb1743
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 3000

renovate.json

@@ -8,7 +8,8 @@
   "rebaseWhen": "behind-base-branch",
   "extends": [
     "replacements:k8s-registry-move",
-    "local>averagemarcus/renovate-config//source-urls"
+    "local>averagemarcus/renovate-config//source-urls",
+    "docker:pinDigests"
   ],
   "ignorePaths": [
     "terraform"
@@ -21,5 +22,14 @@
   },
   "kubernetes": {
     "fileMatch": ["manifests/.+\\.yaml$"]
-  }
+  },
+  "argocd": {
+    "managerFilePatterns": ["/manifests/_apps/.+\\.yaml$/"]
+  },
+  "packageRules": [
+    {
+      "matchCurrentValue": "/(latest|full)/",
+      "pinDigests": false
+    }
+  ]
 }