Update quay.io/oauth2-proxy/oauth2-proxy Docker tag to v7.15.3

Reviewed-on: #723

manifests/_apps/certmanager_chart.yaml

@@ -35,7 +35,7 @@ spec:
     name: cluster-fun (v2)
   source:
     repoURL: 'https://charts.jetstack.io'
-    targetRevision: 1.11.0
+    targetRevision: v1.20.2
     chart: cert-manager
     helm:
       version: v3

manifests/_apps/dashboard.yaml

@@ -22,5 +22,9 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image
 
 ---

manifests/_apps/homelab-accesible-check.yaml

@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cluster-fun-homelab-accessible-check
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: homelab-accessible-check
+    name: cluster-fun (v2)
+  source:
+    path: manifests/homelab-accessible-check
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+
+---

manifests/_apps/mazanoke.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: mazanoke
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: mazanoke
+    name: cluster-fun (v2)
+  source:
+    path: manifests/mazanoke
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+

manifests/_apps/pairdrop.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: pairdrop
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: pairdrop
+    name: cluster-fun (v2)
+  source:
+    path: manifests/pairdrop
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+

manifests/_apps/planning-poker.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: planning-poker
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: planning-poker
+    name: cluster-fun (v2)
+  source:
+    path: manifests/planning-poker
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+

manifests/_apps/reloader.yaml

@@ -12,7 +12,7 @@ spec:
     name: cluster-fun (v2)
   source:
     repoURL: 'https://stakater.github.io/stakater-charts'
-    targetRevision: v0.0.89
+    targetRevision: v0.0.129
     chart: reloader
   syncPolicy:
     automated: {}

manifests/_apps/trek.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: trek
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: trek
+    name: cluster-fun (v2)
+  source:
+    path: manifests/trek
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+

manifests/_apps/url-to-grist.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: url-to-grist
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: cloudnative-now
+    name: cluster-fun (v2)
+  source:
+    path: manifests/url-to-grist
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated: {}
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+---

manifests/_apps/vert.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vert
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: vert
+    name: cluster-fun (v2)
+  source:
+    path: manifests/vert
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+

manifests/auth-proxy/internal-services.yaml

@@ -83,3 +83,20 @@ spec:
     app: internal-proxy
   type: ClusterIP
 ---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hermes
+  namespace: auth-proxy
+  labels:
+    app: internal-proxy
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: internal-proxy
+  type: ClusterIP
+---

manifests/auth-proxy/non-auth-ingress.yaml

@@ -18,6 +18,7 @@ spec:
     - ombi.cluster.fun
     - bsky-feeds.cluster.fun
     - ai.cluster.fun
+    - penpot.cluster.fun
     secretName: non-auth-proxy-ingress
   rules:
   - host: hello-world.cluster.fun
@@ -60,3 +61,13 @@ spec:
             name: tailscale-proxy
             port:
               name: non-auth
+  - host: penpot.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: non-auth

manifests/auth-proxy/proxy.yaml

@@ -13,7 +13,9 @@ data:
       "loki.auth-proxy.svc": "loki-write.cluster.local",
       "loki.auth-proxy.svc:80": "loki-write.cluster.local",
       "loki-distributed.auth-proxy.svc": "loki-loki.cluster.local",
-      "loki-distributed.auth-proxy.svc:80": "loki-loki.cluster.local"
+      "loki-distributed.auth-proxy.svc:80": "loki-loki.cluster.local",
+      "hermes.auth-proxy.svc": "hermes.cluster.local",
+      "hermes.auth-proxy.svc:80": "hermes.cluster.local"
     }
 ---
 apiVersion: apps/v1
@@ -68,7 +70,7 @@ spec:
           mountPath: /config/
 
       - name: oauth-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
         args:
         - --cookie-secure=false
         - --provider=oidc

manifests/cors-proxy/cors-proxy.yaml

@@ -36,7 +36,7 @@ spec:
           name: web
         env:
         - name: ALLOWLIST
-          value: cdn.bsky.app
+          value: cdn.bsky.app,en.wikipedia.org
         resources:
           requests:
             memory: 184M

manifests/dashboard/dashboard.yaml

@@ -81,7 +81,7 @@ spec:
             secretKeyRef:
               key: password
               name: dashboard-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
         name: oauth-proxy
         ports:
         - containerPort: 8000

manifests/gitea/gitea.yaml

@@ -43,7 +43,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: git
-        image: gitea/gitea:1.25.1
+        image: gitea/gitea:1.26.2
         env:
         - name: APP_NAME
           value: "Git"
@@ -77,7 +77,7 @@ spec:
           name: web
         resources:
           requests:
-            memory: 800Mi
+            memory: 700Mi
         volumeMounts:
         - mountPath: /data
           name: git-data

manifests/goplayground/goplayground.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: x1unix/go-playground:2.5.7
+        image: x1unix/go-playground:3.0.0
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 8000

manifests/grist/grist.yaml

@@ -75,7 +75,7 @@ spec:
       priorityClassName: critical
       containers:
         - name: grist
-          image: gristlabs/grist-oss:1.7.6
+          image: gristlabs/grist-oss:1.7.14
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
@@ -110,7 +110,7 @@ spec:
             requests:
               memory: 300M
             limits:
-              memory: 300M
+              memory: 600M
           securityContext:
             capabilities:
               add:

manifests/homelab-accessible-check/homelab-accessible-check.yaml

@@ -0,0 +1,53 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: docker-config
+  namespace: homelab-accessible-check
+  annotations:
+    kube-1password: i6ngbk5zf4k52xgwdwnfup5bby
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-key: .dockerconfigjson
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: e30=
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: homelab-accessible-check
+  namespace: homelab-accessible-check
+  annotations:
+    kube-1password: bz6ujxc5neqma242lpfqdxfiay
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+type: Opaque
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: homelab-accessible-check
+  namespace: homelab-accessible-check
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: homelab-accessible-check
+  template:
+    metadata:
+      labels:
+        app: homelab-accessible-check
+    spec:
+      imagePullSecrets:
+        - name: docker-config
+      containers:
+      - name: checker
+        image: rg.fr-par.scw.cloud/averagemarcus-private/homelab-accessible-check:latest
+        imagePullPolicy: Always
+        envFrom:
+        - secretRef:
+            name: "homelab-accessible-check"
+        resources:
+          limits:
+            memory: 50Mi
+          requests:
+            memory: 50Mi

manifests/link/link.yaml

@@ -35,6 +35,13 @@ data:
     cnsmunich-feedback: https://yay-or-nay.cluster.fun/feedback/20UETBI0
     containerdays25: https://speaking.marcusnoble.co.uk/HARSlE/the-future-of-kubernetes-admission-logic
     containerdays25-feedback: https://yay-or-nay.cluster.fun/feedback/F8P351QK
+    cdl-2026: https://speaking.marcusnoble.co.uk/lMcEwR/pod-deep-dive-the-interesting-bits
+    cdl-2026-feedback: https://yay-or-nay.cluster.fun/feedback/EMLARINI
+    cdl-talk-2026: https://speaking.marcusnoble.co.uk/0rRvmv/debugging-your-conference-talk-practical-tips-to-resonate-with-your-audience
+    cdl-talk-2026-feedback: https://yay-or-nay.cluster.fun/feedback/22TO05MQ
+    technical-talking-blog-post: https://marcusnoble.co.uk/2025-04-30-my-tips-on-giving-technical-talks/
+    kubecon-eu-26: https://speaking.marcusnoble.co.uk/zT471P/kube-oddities-the-quirks-that-keep-kubernetes-interesting
+    cndro26: https://speaking.marcusnoble.co.uk/1OrBAe/kube-oddities-the-quirks-that-keep-kubernetes-interesting-marcus-noble-mark-sagi-kazar
 ---
 apiVersion: v1
 kind: Service
@@ -59,6 +66,8 @@ metadata:
   namespace: link
   labels:
     app: link
+  annotations:
+    secret.reloader.stakater.com/reload: "urls-map"
 spec:
   replicas: 1
   selector:

manifests/marcusnoble/marcusnoble.yaml

@@ -39,16 +39,16 @@ spec:
             memory: 50Mi
           requests:
             memory: 50Mi
-        # livenessProbe:
-        #   httpGet:
-        #     path: /healthz
-        #     port: web
-        #   initialDelaySeconds: 10
-        # readinessProbe:
-        #   httpGet:
-        #     path: /healthz
-        #     port: web
-        #   initialDelaySeconds: 10
+        livenessProbe:
+          httpGet:
+            path: /
+            port: web
+          initialDelaySeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /
+            port: web
+          initialDelaySeconds: 10
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress

manifests/mazanoke/manifest.yaml

@@ -0,0 +1,69 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mazanoke
+  namespace: mazanoke
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: mazanoke
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mazanoke
+  namespace: mazanoke
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mazanoke
+  template:
+    metadata:
+      labels:
+        app: mazanoke
+    spec:
+      containers:
+      - name: web
+        image: ghcr.io/civilblur/mazanoke:v1.1.6
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 80
+          name: web
+        resources:
+          limits:
+            memory: 200Mi
+          requests:
+            memory: 200Mi
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: mazanoke
+  namespace: mazanoke
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - image.cluster.fun
+    secretName: mazanoke-ingress
+  rules:
+  - host: image.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: mazanoke
+            port:
+              number: 80
+

manifests/mealie/mealie.yaml

@@ -31,7 +31,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: frontend
-        image: ghcr.io/mealie-recipes/mealie:v3.4.0
+        image: ghcr.io/mealie-recipes/mealie:v3.19.2
         imagePullPolicy: Always
         envFrom:
         - secretRef:
@@ -72,10 +72,10 @@ spec:
         resources:
           requests:
             cpu: 200m
-            memory: 550M
+            memory: 375Mi
           limits:
             cpu: 1000m
-            memory: 550M
+            memory: 550Mi
       volumes:
       - name: data
         persistentVolumeClaim:

manifests/monitoring/cadvisor.yaml

@@ -38,7 +38,7 @@ spec:
           operator: "Exists"
       automountServiceAccountToken: false
       containers:
-      - image: ghcr.io/google/cadvisor:v0.53.0
+      - image: ghcr.io/google/cadvisor:v0.57.0
         name: cadvisor
         ports:
         - containerPort: 8080
@@ -47,7 +47,7 @@ spec:
         resources:
           limits:
             cpu: 800m
-            memory: 2000Mi
+            memory: 800Mi
           requests:
             cpu: 400m
             memory: 400Mi

manifests/monitoring/ephemeral-storage-exporter.yaml

@@ -78,7 +78,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: metrics
-          image: ghcr.io/jmcgrath207/k8s-ephemeral-storage-metrics:1.18.2
+          image: ghcr.io/jmcgrath207/k8s-ephemeral-storage-metrics:1.19.2
           imagePullPolicy: IfNotPresent
           ports:
             - name: metrics

manifests/monitoring/kube-state-metrics.yaml

@@ -238,7 +238,7 @@ spec:
         - --resources=validatingwebhookconfigurations
         #- --resources=volumeattachments
         imagePullPolicy: IfNotPresent
-        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0"
+        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0"
         ports:
         - containerPort: 8080
         livenessProbe:

manifests/monitoring/node-exporter.yaml

@@ -55,7 +55,7 @@ spec:
       serviceAccountName: prometheus-node-exporter
       containers:
         - name: prometheus-node-exporter
-          image: "prom/node-exporter:v1.10.2"
+          image: "prom/node-exporter:v1.11.1"
           imagePullPolicy: "IfNotPresent"
           args:
             - --path.procfs=/host/proc

manifests/monitoring/promtail.yaml

@@ -216,7 +216,7 @@ spec:
       serviceAccountName: promtail
       containers:
         - name: promtail
-          image: "grafana/promtail:2.9.16"
+          image: "grafana/promtail:2.9.17"
           imagePullPolicy: IfNotPresent
           args:
             - "-config.file=/etc/promtail/promtail.yaml"

manifests/monitoring/vmagent.yaml

@@ -217,7 +217,7 @@ spec:
       serviceAccountName: prometheus-server
       containers:
         - name: vmagent
-          image: "victoriametrics/vmagent:v1.129.1"
+          image: "victoriametrics/vmagent:v1.145.0"
           imagePullPolicy: "IfNotPresent"
           args:
             - -remoteWrite.url=http://vmcluster.auth-proxy.svc/insert/0/prometheus/

manifests/nextcloud_chart/manifest.yaml

@@ -56,7 +56,9 @@ data:
   general.config.php: |-
     <?php
     $CONFIG = array (
-        'overwriteprotocol' => 'https'
+        'overwriteprotocol' => 'https',
+        'loglevel' => 1,
+        'log_rotate_size' => 100 * 1024 * 1024
     );
   .htaccess: |-
     # line below if for Apache 2.4
@@ -204,7 +206,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: nextcloud
-        image: "nextcloud:32.0.1-apache"
+        image: "nextcloud:33.0.5-apache"
         imagePullPolicy: IfNotPresent
         env:
         - name: SQLITE_DATABASE
@@ -284,7 +286,7 @@ spec:
         resources:
           requests:
             cpu: 1038m
-            memory: 765M
+            memory: 500M
           limits:
             cpu: 1200m
             memory: 765M
@@ -337,6 +339,97 @@ spec:
         - name: nextcloud-config
           mountPath: /var/www/html/config/smtp.config.php
           subPath: smtp.config.php
+      - name: cron
+        image: "nextcloud:33.0.5-apache"
+        imagePullPolicy: IfNotPresent
+        command:
+          - /cron.sh
+        env:
+          - name: SQLITE_DATABASE
+            value: "nextcloud"
+          - name: NEXTCLOUD_ADMIN_USER
+            valueFrom:
+              secretKeyRef:
+                name: nextcloud-nextcloud
+                key: nextcloud-username
+          - name: NEXTCLOUD_ADMIN_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: nextcloud-nextcloud
+                key: nextcloud-password
+          - name: NEXTCLOUD_TRUSTED_DOMAINS
+            value: nextcloud.cluster.fun
+          - name: NEXTCLOUD_DATA_DIR
+            value: "/var/www/html/data"
+          - name: REDIS_HOST
+            valueFrom:
+              secretKeyRef:
+                name: nextcloud-nextcloud-redis
+                key: redis-host
+          - name: REDIS_PORT
+            valueFrom:
+              secretKeyRef:
+                name: nextcloud-nextcloud-redis
+                key: redis-port
+          - name: REDIS_HOST_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: nextcloud-nextcloud-redis
+                key: redis-password
+          - name: REDIS_DB_INDEX
+            valueFrom:
+              secretKeyRef:
+                name: nextcloud-nextcloud-redis
+                key: redis-db-index
+        volumeMounts:
+        - name: nextcloud-data
+          mountPath: /var/www/
+          subPath: root
+        - name: nextcloud-data
+          mountPath: /var/www/html
+          subPath: html
+        - name: nextcloud-data
+          mountPath: /var/www/html/data
+          subPath: data
+        - name: nextcloud-data
+          mountPath: /var/www/html/config
+          subPath: config
+        - name: nextcloud-data
+          mountPath: /var/www/html/custom_apps
+          subPath: custom_apps
+        - name: nextcloud-data
+          mountPath: /var/www/tmp
+          subPath: tmp
+        - name: nextcloud-data
+          mountPath: /var/www/html/themes
+          subPath: themes
+        - name: nextcloud-config
+          mountPath: /var/www/html/config/general.config.php
+          subPath: general.config.php
+        - name: nextcloud-s3
+          mountPath: /var/www/html/config/s3.config.php
+          subPath: s3.config.php
+        - name: nextcloud-config
+          mountPath: /var/www/html/config/.htaccess
+          subPath: .htaccess
+        - name: nextcloud-config
+          mountPath: /var/www/html/config/apache-pretty-urls.config.php
+          subPath: apache-pretty-urls.config.php
+        - name: nextcloud-config
+          mountPath: /var/www/html/config/apcu.config.php
+          subPath: apcu.config.php
+        - name: nextcloud-config
+          mountPath: /var/www/html/config/apps.config.php
+          subPath: apps.config.php
+        - name: nextcloud-config
+          mountPath: /var/www/html/config/autoconfig.php
+          subPath: autoconfig.php
+        - name: nextcloud-config
+          mountPath: /var/www/html/config/redis.config.php
+          subPath: redis.config.php
+        - name: nextcloud-config
+          mountPath: /var/www/html/config/smtp.config.php
+          subPath: smtp.config.php
       volumes:
       - name: nextcloud-data
         persistentVolumeClaim:
@@ -351,45 +444,6 @@ spec:
       securityContext:
         fsGroup: 33
 ---
-# Source: nextcloud/templates/cronjob.yaml
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: nextcloud-nextcloud-cron
-  labels:
-    app.kubernetes.io/name: nextcloud
-    app.kubernetes.io/instance: nextcloud-nextcloud
-  annotations:
-    {}
-spec:
-  schedule: "*/5 * * * *"
-  concurrencyPolicy: Forbid
-  failedJobsHistoryLimit: 5
-  successfulJobsHistoryLimit: 2
-  jobTemplate:
-    metadata:
-      labels:
-        app.kubernetes.io/name: nextcloud
-    spec:
-      template:
-        metadata:
-          labels:
-            app.kubernetes.io/name: nextcloud
-        spec:
-          restartPolicy: Never
-          containers:
-            - name: nextcloud
-              image: "nextcloud:32.0.1-apache"
-              imagePullPolicy: IfNotPresent
-              command: [ "curl" ]
-              args:
-                - "--fail"
-                - "-L"
-                - "https://nextcloud.cluster.fun/cron.php"
-              resources:
-                requests:
-                  memory: 200Mi
----
 # Source: nextcloud/templates/ingress.yaml
 apiVersion: networking.k8s.io/v1
 kind: Ingress

manifests/nginx-lb/nginx-lb.yaml

@@ -492,7 +492,7 @@ spec:
               fieldPath: metadata.namespace
         - name: LD_PRELOAD
           value: /usr/local/lib/libmimalloc.so
-        image: registry.k8s.io/ingress-nginx/controller:v1.14.0@sha256:e4127065d0317bd11dc64c4dd38dcf7fb1c3d72e468110b4086e636dbaac943d
+        image: registry.k8s.io/ingress-nginx/controller:v1.15.1@sha256:594ceea76b01c592858f803f9ff4d2cb40542cae2060410b2c95f75907d659e1
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:

manifests/nodered/nodered.yaml

@@ -57,7 +57,7 @@ spec:
           - name: data
             mountPath: /data
       - name: update-native-modules
-        image: nodered/node-red:4.1.1-18
+        image: nodered/node-red:4.1.11-18
         imagePullPolicy: IfNotPresent
         command:
           - bash
@@ -73,7 +73,7 @@ spec:
             mountPath: /data
       containers:
       - name: web
-        image: nodered/node-red:4.1.1-18
+        image: nodered/node-red:4.1.11-18
         imagePullPolicy: Always
         ports:
         - containerPort: 1880

manifests/outline/outline.yaml

@@ -46,7 +46,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: outline
-        image: outlinewiki/outline:1.0.1
+        image: outlinewiki/outline:1.8.1
         imagePullPolicy: IfNotPresent
         env:
         - name: ALLOWED_DOMAINS
@@ -73,9 +73,9 @@ spec:
         resources:
           requests:
             cpu: 8m
-            memory: 1389M
+            memory: 900Mi
           limits:
-            memory: 1489M
+            memory: 1489Mi
         volumeMounts:
           - mountPath: /opt/outline/.env
             subPath: .env

manifests/pairdrop/pairdrop.yaml

@@ -0,0 +1,88 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: pairdrop
+  namespace: pairdrop
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: pairdrop
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pairdrop
+  namespace: pairdrop
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: pairdrop
+  template:
+    metadata:
+      labels:
+        app: pairdrop
+    spec:
+      imagePullSecrets:
+        - name: docker-config
+      priorityClassName: low
+      containers:
+      - name: web
+        image: ghcr.io/schlagmichdoch/pairdrop:v1.11.2
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 3000
+          name: web
+        env:
+        - name: RATE_LIMIT
+          value: "1"
+        - name: DONATION_BUTTON_ACTIVE
+          value: "false"
+        - name: TWITTER_BUTTON_ACTIVE
+          value: "false"
+        - name: MASTODON_BUTTON_ACTIVE
+          value: "false"
+        - name: BLUESKY_BUTTON_ACTIVE
+          value: "false"
+        - name: PRIVACYPOLICY_BUTTON_ACTIVE
+          value: "false"
+        resources:
+          limits:
+            memory: 100Mi
+          requests:
+            memory: 100Mi
+        livenessProbe:
+          httpGet:
+            path: /
+            port: web
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: pairdrop
+  namespace: pairdrop
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - drop.cluster.fun
+    secretName: pairdrop-ingress
+  rules:
+  - host: drop.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: pairdrop
+            port:
+              number: 80

manifests/planning-poker/planning-poker.yaml

@@ -0,0 +1,111 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: planning-poker
+  namespace: planning-poker
+  labels:
+    app.kubernetes.io/name: planning-poker
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: planning-poker-data
+  namespace: planning-poker
+  labels:
+    app.kubernetes.io/name: planning-poker
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "1Gi"
+  storageClassName: "sbs-default-retain"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: planning-poker
+  namespace: planning-poker
+  labels:
+    app.kubernetes.io/name: planning-poker
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: web
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: planning-poker
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: planning-poker
+  namespace: planning-poker
+  labels:
+    app.kubernetes.io/name: planning-poker
+  annotations:
+    secret.reloader.stakater.com/reload: "planning-poker"
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: planning-poker
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: planning-poker
+    spec:
+      serviceAccountName: planning-poker
+      priorityClassName: critical
+      containers:
+        - name: planning-poker
+          image: ghcr.io/axeleroy/self-host-planning-poker:1.2.1
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: web
+              containerPort: 8000
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: web
+          readinessProbe:
+            tcpSocket:
+              port: web
+          volumeMounts:
+            - name: data
+              mountPath: /data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: planning-poker-data
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: planning-poker
+  namespace: planning-poker
+  labels:
+    app.kubernetes.io/name: planning-poker
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - planning-poker.cluster.fun
+    secretName: planning-poker-ingress
+  rules:
+    - host: "planning-poker.cluster.fun"
+      http:
+        paths:
+          - path: /
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: planning-poker
+                port:
+                  number: 80

manifests/rss/miniflux.yaml

@@ -68,7 +68,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: ghcr.io/miniflux/miniflux:2.2.14
+        image: ghcr.io/miniflux/miniflux:2.3.1
         imagePullPolicy: IfNotPresent
         envFrom:
         - configMapRef:

manifests/social-to-rolodex/social-to-rolodex.yaml

@@ -92,7 +92,7 @@ spec:
             secretKeyRef:
               key: password
               name: social-to-rolodex-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
         name: oauth-proxy
         ports:
         - containerPort: 8000

manifests/traefik/traefik.yaml

@@ -45,7 +45,7 @@ spec:
         - --entrypoints.websecure.http.tls=true
         - --entrypoints.web.http.redirections.entrypoint.to=websecure
         - --entrypoints.web.http.redirections.entrypoint.scheme=https
-        image: rancher/mirrored-library-traefik:2.11.29
+        image: rancher/mirrored-library-traefik:2.11.42
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3

manifests/trek/pvs.yaml

@@ -0,0 +1,26 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: trek-data
+  namespace: trek
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+  storageClassName: sbs-default-retain
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: trek-uploads
+  namespace: trek
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+  storageClassName: sbs-default-retain
+---

manifests/trek/trek.yaml

@@ -0,0 +1,157 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: trek
+  namespace: trek
+  labels:
+    app: trek
+    app.kubernetes.io/name: trek
+  annotations:
+    kube-1password: irpjqi7ppvbvldfni7ywgorpgi
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+type: Opaque
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trek
+  namespace: trek
+  labels:
+    app: trek
+    app.kubernetes.io/name: trek
+  annotations:
+    reloader.stakater.com/match: "true"
+data:
+  NODE_ENV: "production"
+  PORT: "3000"
+  TZ: "UTC"
+  LOG_LEVEL: "info"
+  DEFAULT_LANGUAGE: "en"
+  ALLOWED_ORIGINS: "https://trek.cluster.fun"
+  APP_URL: "https://trek.cluster.fun"
+  FORCE_HTTPS: "false"
+  COOKIE_SECURE: "true"
+
+---
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: trek
+  namespace: trek
+  labels:
+    app: trek
+    app.kubernetes.io/name: trek
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: trek
+  template:
+    metadata:
+      labels:
+        app: trek
+        app.kubernetes.io/name: trek
+    spec:
+      containers:
+      - name: trek
+        image: mauriceboe/trek:3.0.22
+        imagePullPolicy: IfNotPresent
+        envFrom:
+        - configMapRef:
+            name: trek
+        - secretRef:
+            name: trek
+        ports:
+        - containerPort: 3000
+          name: web
+        volumeMounts:
+          - mountPath: /app/data
+            name: data
+          - mountPath: /app/uploads
+            name: uploads
+        livenessProbe:
+          httpGet:
+            path: /api/health
+            port: 3000
+          initialDelaySeconds: 5
+          periodSeconds: 30
+        readinessProbe:
+          httpGet:
+            path: /api/health
+            port: 3000
+          initialDelaySeconds: 5
+          periodSeconds: 10
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: trek-data
+      - name: uploads
+        persistentVolumeClaim:
+          claimName: trek-uploads
+
+---
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: trek
+  namespace: trek
+  labels:
+    app: trek
+    app.kubernetes.io/name: trek
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: trek
+---
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: trek
+  namespace: trek
+  labels:
+    app: trek
+    app.kubernetes.io/name: trek
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/client-body-buffer-size: 25m
+    nginx.ingress.kubernetes.io/proxy-connect-timeout: "300"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
+    nginx.ingress.kubernetes.io/proxy-next-upstream: "300"
+    nginx.ingress.kubernetes.io/proxy-next-upstream-timeout: "300"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - trek.cluster.fun
+    secretName: trek-ingress
+  rules:
+  - host: trek.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: trek
+            port:
+              name: web

manifests/url-to-grist/url-to-grist.yaml

@@ -0,0 +1,117 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: url-to-grist
+  namespace: cloudnative-now
+  annotations:
+    kube-1password: bu4lczquzosu3yxhyrzbtepply
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+  labels:
+    app.kubernetes.io/name: url-to-grist
+    app.kubernetes.io/part-of: cloudnative.now
+type: Opaque
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: url-to-grist
+  labels:
+    app.kubernetes.io/name: url-to-grist
+    app.kubernetes.io/part-of: cloudnative.now
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app.kubernetes.io/name: url-to-grist
+    app.kubernetes.io/part-of: cloudnative.now
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: url-to-grist
+  labels:
+    app.kubernetes.io/name: url-to-grist
+    app.kubernetes.io/part-of: cloudnative.now
+  annotations:
+    secret.reloader.stakater.com/reload: "url-to-grist"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: url-to-grist
+      app.kubernetes.io/part-of: cloudnative.now
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: url-to-grist
+        app.kubernetes.io/part-of: cloudnative.now
+    spec:
+      containers:
+      - name: url-to-grist
+        image: ghcr.io/namelessplanet/url-to-grist:v1.6.1
+        imagePullPolicy: IfNotPresent
+        env:
+        - name: PORT
+          value: "8080"
+        envFrom:
+        - secretRef:
+            name: "url-to-grist"
+        ports:
+        - containerPort: 8080
+          name: web
+        livenessProbe:
+          httpGet:
+            port: web
+            path: /healthz
+          initialDelaySeconds: 1
+          periodSeconds: 5
+          successThreshold: 1
+          failureThreshold: 3
+          timeoutSeconds: 3
+        readinessProbe:
+          httpGet:
+            port: web
+            path: /healthz
+          initialDelaySeconds: 1
+          periodSeconds: 5
+          successThreshold: 1
+          failureThreshold: 3
+          timeoutSeconds: 3
+        resources:
+          limits:
+            memory: 20Mi
+          requests:
+            memory: 20Mi
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: url-to-grist
+  namespace: cloudnative-now
+  labels:
+    app.kubernetes.io/name: url-to-grist
+    app.kubernetes.io/part-of: cloudnative.now
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - "url-to-grist.cloudnative.now"
+      secretName: "url-to-grist-ingress"
+  rules:
+    - host: "url-to-grist.cloudnative.now"
+      http:
+        paths:
+          - path: "/"
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: url-to-grist
+                port:
+                  name: web

manifests/vert/manifest.yaml

@@ -0,0 +1,69 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: vert
+  namespace: vert
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: vert
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vert
+  namespace: vert
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vert
+  template:
+    metadata:
+      labels:
+        app: vert
+    spec:
+      containers:
+      - name: web
+        image: ghcr.io/vert-sh/vert:sha-438f91a
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 80
+          name: web
+        resources:
+          limits:
+            memory: 200Mi
+          requests:
+            memory: 200Mi
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vert
+  namespace: vert
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - vert.cluster.fun
+    secretName: vert-ingress
+  rules:
+  - host: vert.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: vert
+            port:
+              number: 80
+

manifests/yay-or-nay/yay-or-nay.yaml

@@ -17,7 +17,7 @@ metadata:
     app: yay-or-nay
     app.kubernetes.io/name: yay-or-nay
   annotations:
-    reloader.stakater.com/search: "true"
+    secret.reloader.stakater.com/reload: "yay-or-nay"
 spec:
   replicas: 1
   selector:
@@ -31,7 +31,7 @@ spec:
     spec:
       containers:
       - name: yay-or-nay
-        image: ghcr.io/mocdaniel/yay-or-nay:1.1.1
+        image: ghcr.io/mocdaniel/yay-or-nay:1.2.1
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 3000

renovate.json

@@ -21,5 +21,8 @@
   },
   "kubernetes": {
     "fileMatch": ["manifests/.+\\.yaml$"]
+  },
+  "argocd": {
+    "managerFilePatterns": ["/manifests/_apps/.+\\.yaml$/"]
   }
 }