Update grafana/promtail Docker tag to v3

Reviewed-on: #644

manifests/_apps/certmanager_chart.yaml

@@ -35,7 +35,7 @@ spec:
     name: cluster-fun (v2)
   source:
     repoURL: 'https://charts.jetstack.io'
-    targetRevision: 1.11.0
+    targetRevision: v1.19.3
     chart: cert-manager
     helm:
       version: v3

manifests/_apps/dashboard.yaml

@@ -22,5 +22,9 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image
 
 ---

manifests/_apps/mazanoke.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: mazanoke
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: mazanoke
+    name: cluster-fun (v2)
+  source:
+    path: manifests/mazanoke
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+

manifests/_apps/reloader.yaml

@@ -12,7 +12,7 @@ spec:
     name: cluster-fun (v2)
   source:
     repoURL: 'https://stakater.github.io/stakater-charts'
-    targetRevision: v0.0.89
+    targetRevision: v0.0.129
     chart: reloader
   syncPolicy:
     automated: {}

manifests/auth-proxy/non-auth-ingress.yaml

@@ -18,6 +18,7 @@ spec:
     - ombi.cluster.fun
     - bsky-feeds.cluster.fun
     - ai.cluster.fun
+    - penpot.cluster.fun
     secretName: non-auth-proxy-ingress
   rules:
   - host: hello-world.cluster.fun
@@ -60,3 +61,13 @@ spec:
             name: tailscale-proxy
             port:
               name: non-auth
+  - host: penpot.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: tailscale-proxy
+            port:
+              name: non-auth

manifests/auth-proxy/proxy.yaml

@@ -68,7 +68,7 @@ spec:
           mountPath: /config/
 
       - name: oauth-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.13.0
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.14.2
         args:
         - --cookie-secure=false
         - --provider=oidc

manifests/dashboard/dashboard.yaml

@@ -81,7 +81,7 @@ spec:
             secretKeyRef:
               key: password
               name: dashboard-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.13.0
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.14.2
         name: oauth-proxy
         ports:
         - containerPort: 8000

manifests/gitea/gitea.yaml

@@ -43,7 +43,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: git
-        image: gitea/gitea:1.25.3
+        image: gitea/gitea:1.25.4
         env:
         - name: APP_NAME
           value: "Git"

manifests/goplayground/goplayground.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: x1unix/go-playground:2.5.7
+        image: x1unix/go-playground:2.5.8
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 8000

manifests/grist/grist.yaml

@@ -75,7 +75,7 @@ spec:
       priorityClassName: critical
       containers:
         - name: grist
-          image: gristlabs/grist-oss:1.7.8
+          image: gristlabs/grist-oss:1.7.10
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

manifests/link/link.yaml

@@ -37,6 +37,10 @@ data:
     containerdays25-feedback: https://yay-or-nay.cluster.fun/feedback/F8P351QK
     cdl-2026: https://speaking.marcusnoble.co.uk/lMcEwR/pod-deep-dive-the-interesting-bits
     cdl-2026-feedback: https://yay-or-nay.cluster.fun/feedback/EMLARINI
+    cdl-talk-2026: https://speaking.marcusnoble.co.uk/0rRvmv/debugging-your-conference-talk-practical-tips-to-resonate-with-your-audience
+    cdl-talk-2026-feedback: https://yay-or-nay.cluster.fun/feedback/22TO05MQ
+    technical-talking-blog-post: https://marcusnoble.co.uk/2025-04-30-my-tips-on-giving-technical-talks/
+    kubecon-eu-26: https://speaking.marcusnoble.co.uk/zT471P/kube-oddities-the-quirks-that-keep-kubernetes-interesting
 ---
 apiVersion: v1
 kind: Service
@@ -61,6 +65,8 @@ metadata:
   namespace: link
   labels:
     app: link
+  annotations:
+    secret.reloader.stakater.com/reload: "urls-map"
 spec:
   replicas: 1
   selector:

manifests/mazanoke/manifest.yaml

@@ -0,0 +1,69 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mazanoke
+  namespace: mazanoke
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: mazanoke
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mazanoke
+  namespace: mazanoke
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mazanoke
+  template:
+    metadata:
+      labels:
+        app: mazanoke
+    spec:
+      containers:
+      - name: web
+        image: ghcr.io/civilblur/mazanoke:v1.1.5
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 80
+          name: web
+        resources:
+          limits:
+            memory: 200Mi
+          requests:
+            memory: 200Mi
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: mazanoke
+  namespace: mazanoke
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - image.cluster.fun
+    secretName: mazanoke-ingress
+  rules:
+  - host: image.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: mazanoke
+            port:
+              number: 80
+

manifests/mealie/mealie.yaml

@@ -31,7 +31,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: frontend
-        image: ghcr.io/mealie-recipes/mealie:v3.8.0
+        image: ghcr.io/mealie-recipes/mealie:v3.9.2
         imagePullPolicy: Always
         envFrom:
         - secretRef:

manifests/monitoring/cadvisor.yaml

@@ -38,7 +38,7 @@ spec:
           operator: "Exists"
       automountServiceAccountToken: false
       containers:
-      - image: ghcr.io/google/cadvisor:0.55.0
+      - image: ghcr.io/google/cadvisor:0.56.2
         name: cadvisor
         ports:
         - containerPort: 8080

manifests/monitoring/ephemeral-storage-exporter.yaml

@@ -78,7 +78,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: metrics
-          image: ghcr.io/jmcgrath207/k8s-ephemeral-storage-metrics:1.19.1
+          image: ghcr.io/jmcgrath207/k8s-ephemeral-storage-metrics:1.19.2
           imagePullPolicy: IfNotPresent
           ports:
             - name: metrics

manifests/monitoring/kube-state-metrics.yaml

@@ -238,7 +238,7 @@ spec:
         - --resources=validatingwebhookconfigurations
         #- --resources=volumeattachments
         imagePullPolicy: IfNotPresent
-        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0"
+        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0"
         ports:
         - containerPort: 8080
         livenessProbe:

manifests/monitoring/promtail.yaml

@@ -216,7 +216,7 @@ spec:
       serviceAccountName: promtail
       containers:
         - name: promtail
-          image: "grafana/promtail:2.9.17"
+          image: "grafana/promtail:3.6.4"
           imagePullPolicy: IfNotPresent
           args:
             - "-config.file=/etc/promtail/promtail.yaml"

manifests/monitoring/vmagent.yaml

@@ -217,7 +217,7 @@ spec:
       serviceAccountName: prometheus-server
       containers:
         - name: vmagent
-          image: "victoriametrics/vmagent:v1.132.0"
+          image: "victoriametrics/vmagent:v1.135.0"
           imagePullPolicy: "IfNotPresent"
           args:
             - -remoteWrite.url=http://vmcluster.auth-proxy.svc/insert/0/prometheus/

manifests/nextcloud_chart/manifest.yaml

@@ -206,7 +206,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: nextcloud
-        image: "nextcloud:32.0.3-apache"
+        image: "nextcloud:32.0.5-apache"
         imagePullPolicy: IfNotPresent
         env:
         - name: SQLITE_DATABASE
@@ -340,7 +340,7 @@ spec:
           mountPath: /var/www/html/config/smtp.config.php
           subPath: smtp.config.php
       - name: cron
-        image: "nextcloud:32.0.3-apache"
+        image: "nextcloud:32.0.5-apache"
         imagePullPolicy: IfNotPresent
         command:
           - /cron.sh

manifests/nginx-lb/nginx-lb.yaml

@@ -492,7 +492,7 @@ spec:
               fieldPath: metadata.namespace
         - name: LD_PRELOAD
           value: /usr/local/lib/libmimalloc.so
-        image: registry.k8s.io/ingress-nginx/controller:v1.14.1@sha256:f95a79b85fb93ac3de752c71a5c27d5ceae10a18b61904dec224c1c6a4581e47
+        image: registry.k8s.io/ingress-nginx/controller:v1.14.2@sha256:fb3e5c0bdff6a498dd5192b11a09ace0739baa9fe6ba519bf5b22425871ce490
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:

manifests/nodered/nodered.yaml

@@ -57,7 +57,7 @@ spec:
           - name: data
             mountPath: /data
       - name: update-native-modules
-        image: nodered/node-red:4.1.2-18
+        image: nodered/node-red:4.1.4-18
         imagePullPolicy: IfNotPresent
         command:
           - bash
@@ -73,7 +73,7 @@ spec:
             mountPath: /data
       containers:
       - name: web
-        image: nodered/node-red:4.1.2-18
+        image: nodered/node-red:4.1.4-18
         imagePullPolicy: Always
         ports:
         - containerPort: 1880

manifests/outline/outline.yaml

@@ -46,7 +46,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: outline
-        image: outlinewiki/outline:1.1.0
+        image: outlinewiki/outline:1.4.0
         imagePullPolicy: IfNotPresent
         env:
         - name: ALLOWED_DOMAINS

manifests/rss/miniflux.yaml

@@ -68,7 +68,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: ghcr.io/miniflux/miniflux:2.2.15
+        image: ghcr.io/miniflux/miniflux:2.2.16
         imagePullPolicy: IfNotPresent
         envFrom:
         - configMapRef:

manifests/social-to-rolodex/social-to-rolodex.yaml

@@ -92,7 +92,7 @@ spec:
             secretKeyRef:
               key: password
               name: social-to-rolodex-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.13.0
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.14.2
         name: oauth-proxy
         ports:
         - containerPort: 8000

manifests/traefik/traefik.yaml

@@ -45,7 +45,7 @@ spec:
         - --entrypoints.websecure.http.tls=true
         - --entrypoints.web.http.redirections.entrypoint.to=websecure
         - --entrypoints.web.http.redirections.entrypoint.scheme=https
-        image: rancher/mirrored-library-traefik:2.11.32
+        image: rancher/mirrored-library-traefik:2.11.34
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3

renovate.json

@@ -21,5 +21,8 @@
   },
   "kubernetes": {
     "fileMatch": ["manifests/.+\\.yaml$"]
+  },
+  "argocd": {
+    "managerFilePatterns": ["/manifests/_apps/.+\\.yaml$/"]
   }
 }