Update ghcr.io/google/cadvisor Docker tag to v0.60.3

Reviewed-on: #734

manifests/_apps/certmanager_chart.yaml

@@ -35,7 +35,7 @@ spec:
     name: cluster-fun (v2)
   source:
     repoURL: 'https://charts.jetstack.io'
-    targetRevision: v1.20.2
+    targetRevision: v1.20.3
     chart: cert-manager
     helm:
       version: v3

manifests/_apps/trek.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: trek
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: trek
+    name: cluster-fun (v2)
+  source:
+    path: manifests/trek
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+

manifests/auth-proxy/internal-services.yaml

@@ -83,3 +83,20 @@ spec:
     app: internal-proxy
   type: ClusterIP
 ---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hermes
+  namespace: auth-proxy
+  labels:
+    app: internal-proxy
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: internal-proxy
+  type: ClusterIP
+---

manifests/auth-proxy/proxy.yaml

@@ -13,7 +13,9 @@ data:
       "loki.auth-proxy.svc": "loki-write.cluster.local",
       "loki.auth-proxy.svc:80": "loki-write.cluster.local",
       "loki-distributed.auth-proxy.svc": "loki-loki.cluster.local",
-      "loki-distributed.auth-proxy.svc:80": "loki-loki.cluster.local"
+      "loki-distributed.auth-proxy.svc:80": "loki-loki.cluster.local",
+      "hermes.auth-proxy.svc": "hermes.cluster.local",
+      "hermes.auth-proxy.svc:80": "hermes.cluster.local"
     }
 ---
 apiVersion: apps/v1
@@ -68,7 +70,7 @@ spec:
           mountPath: /config/
 
       - name: oauth-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
         args:
         - --cookie-secure=false
         - --provider=oidc

manifests/dashboard/dashboard.yaml

@@ -81,7 +81,7 @@ spec:
             secretKeyRef:
               key: password
               name: dashboard-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
         name: oauth-proxy
         ports:
         - containerPort: 8000

manifests/gitea/gitea.yaml

@@ -43,7 +43,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: git
-        image: gitea/gitea:1.26.1
+        image: gitea/gitea:1.26.4
         env:
         - name: APP_NAME
           value: "Git"
@@ -77,7 +77,7 @@ spec:
           name: web
         resources:
           requests:
-            memory: 800Mi
+            memory: 700Mi
         volumeMounts:
         - mountPath: /data
           name: git-data

manifests/grist/grist.yaml

@@ -75,7 +75,7 @@ spec:
       priorityClassName: critical
       containers:
         - name: grist
-          image: gristlabs/grist-oss:1.7.13
+          image: gristlabs/grist-oss:1.7.15
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

manifests/mealie/mealie.yaml

@@ -31,7 +31,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: frontend
-        image: ghcr.io/mealie-recipes/mealie:v3.17.0
+        image: ghcr.io/mealie-recipes/mealie:v3.20.0
         imagePullPolicy: Always
         envFrom:
         - secretRef:
@@ -72,10 +72,10 @@ spec:
         resources:
           requests:
             cpu: 200m
-            memory: 550M
+            memory: 375Mi
           limits:
             cpu: 1000m
-            memory: 550M
+            memory: 550Mi
       volumes:
       - name: data
         persistentVolumeClaim:

manifests/monitoring/cadvisor.yaml

@@ -38,7 +38,7 @@ spec:
           operator: "Exists"
       automountServiceAccountToken: false
       containers:
-      - image: ghcr.io/google/cadvisor:v0.57.0
+      - image: ghcr.io/google/cadvisor:v0.60.3
         name: cadvisor
         ports:
         - containerPort: 8080
@@ -47,7 +47,7 @@ spec:
         resources:
           limits:
             cpu: 800m
-            memory: 2000Mi
+            memory: 800Mi
           requests:
             cpu: 400m
             memory: 400Mi

manifests/monitoring/kube-state-metrics.yaml

@@ -238,7 +238,7 @@ spec:
         - --resources=validatingwebhookconfigurations
         #- --resources=volumeattachments
         imagePullPolicy: IfNotPresent
-        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0"
+        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1"
         ports:
         - containerPort: 8080
         livenessProbe:

manifests/monitoring/vmagent.yaml

@@ -217,7 +217,7 @@ spec:
       serviceAccountName: prometheus-server
       containers:
         - name: vmagent
-          image: "victoriametrics/vmagent:v1.143.0"
+          image: "victoriametrics/vmagent:v1.146.0"
           imagePullPolicy: "IfNotPresent"
           args:
             - -remoteWrite.url=http://vmcluster.auth-proxy.svc/insert/0/prometheus/

manifests/nextcloud_chart/manifest.yaml

@@ -206,7 +206,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: nextcloud
-        image: "nextcloud:33.0.3-apache"
+        image: "nextcloud:34.0.0-apache"
         imagePullPolicy: IfNotPresent
         env:
         - name: SQLITE_DATABASE
@@ -286,7 +286,7 @@ spec:
         resources:
           requests:
             cpu: 1038m
-            memory: 765M
+            memory: 500M
           limits:
             cpu: 1200m
             memory: 765M
@@ -340,7 +340,7 @@ spec:
           mountPath: /var/www/html/config/smtp.config.php
           subPath: smtp.config.php
       - name: cron
-        image: "nextcloud:33.0.3-apache"
+        image: "nextcloud:34.0.0-apache"
         imagePullPolicy: IfNotPresent
         command:
           - /cron.sh

manifests/nodered/nodered.yaml

@@ -57,7 +57,7 @@ spec:
           - name: data
             mountPath: /data
       - name: update-native-modules
-        image: nodered/node-red:4.1.10-18
+        image: nodered/node-red:4.1.11-18
         imagePullPolicy: IfNotPresent
         command:
           - bash
@@ -73,7 +73,7 @@ spec:
             mountPath: /data
       containers:
       - name: web
-        image: nodered/node-red:4.1.10-18
+        image: nodered/node-red:4.1.11-18
         imagePullPolicy: Always
         ports:
         - containerPort: 1880

manifests/outline/outline.yaml

@@ -46,7 +46,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: outline
-        image: outlinewiki/outline:1.7.1
+        image: outlinewiki/outline:1.8.1
         imagePullPolicy: IfNotPresent
         env:
         - name: ALLOWED_DOMAINS
@@ -73,9 +73,9 @@ spec:
         resources:
           requests:
             cpu: 8m
-            memory: 1389M
+            memory: 900Mi
           limits:
-            memory: 1489M
+            memory: 1489Mi
         volumeMounts:
           - mountPath: /opt/outline/.env
             subPath: .env

manifests/rss/miniflux.yaml

@@ -68,7 +68,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: ghcr.io/miniflux/miniflux:2.2.19
+        image: ghcr.io/miniflux/miniflux:2.3.1
         imagePullPolicy: IfNotPresent
         envFrom:
         - configMapRef:

manifests/social-to-rolodex/social-to-rolodex.yaml

@@ -92,7 +92,7 @@ spec:
             secretKeyRef:
               key: password
               name: social-to-rolodex-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
         name: oauth-proxy
         ports:
         - containerPort: 8000

manifests/trek/pvs.yaml

@@ -0,0 +1,26 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: trek-data
+  namespace: trek
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+  storageClassName: sbs-default-retain
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: trek-uploads
+  namespace: trek
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+  storageClassName: sbs-default-retain
+---

manifests/trek/trek.yaml

@@ -0,0 +1,157 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: trek
+  namespace: trek
+  labels:
+    app: trek
+    app.kubernetes.io/name: trek
+  annotations:
+    kube-1password: irpjqi7ppvbvldfni7ywgorpgi
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+type: Opaque
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trek
+  namespace: trek
+  labels:
+    app: trek
+    app.kubernetes.io/name: trek
+  annotations:
+    reloader.stakater.com/match: "true"
+data:
+  NODE_ENV: "production"
+  PORT: "3000"
+  TZ: "UTC"
+  LOG_LEVEL: "info"
+  DEFAULT_LANGUAGE: "en"
+  ALLOWED_ORIGINS: "https://trek.cluster.fun"
+  APP_URL: "https://trek.cluster.fun"
+  FORCE_HTTPS: "false"
+  COOKIE_SECURE: "true"
+
+---
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: trek
+  namespace: trek
+  labels:
+    app: trek
+    app.kubernetes.io/name: trek
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: trek
+  template:
+    metadata:
+      labels:
+        app: trek
+        app.kubernetes.io/name: trek
+    spec:
+      containers:
+      - name: trek
+        image: mauriceboe/trek:3.1.2
+        imagePullPolicy: IfNotPresent
+        envFrom:
+        - configMapRef:
+            name: trek
+        - secretRef:
+            name: trek
+        ports:
+        - containerPort: 3000
+          name: web
+        volumeMounts:
+          - mountPath: /app/data
+            name: data
+          - mountPath: /app/uploads
+            name: uploads
+        livenessProbe:
+          httpGet:
+            path: /api/health
+            port: 3000
+          initialDelaySeconds: 5
+          periodSeconds: 30
+        readinessProbe:
+          httpGet:
+            path: /api/health
+            port: 3000
+          initialDelaySeconds: 5
+          periodSeconds: 10
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: trek-data
+      - name: uploads
+        persistentVolumeClaim:
+          claimName: trek-uploads
+
+---
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: trek
+  namespace: trek
+  labels:
+    app: trek
+    app.kubernetes.io/name: trek
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: trek
+---
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: trek
+  namespace: trek
+  labels:
+    app: trek
+    app.kubernetes.io/name: trek
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/client-body-buffer-size: 25m
+    nginx.ingress.kubernetes.io/proxy-connect-timeout: "300"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
+    nginx.ingress.kubernetes.io/proxy-next-upstream: "300"
+    nginx.ingress.kubernetes.io/proxy-next-upstream-timeout: "300"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - trek.cluster.fun
+    secretName: trek-ingress
+  rules:
+  - host: trek.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: trek
+            port:
+              name: web

manifests/url-to-grist/url-to-grist.yaml

@@ -52,7 +52,7 @@ spec:
     spec:
       containers:
       - name: url-to-grist
-        image: ghcr.io/namelessplanet/url-to-grist:v1.6.0
+        image: ghcr.io/namelessplanet/url-to-grist:v1.6.1
         imagePullPolicy: IfNotPresent
         env:
         - name: PORT