Update rancher/mirrored-library-traefik Docker tag to v3

Signed-off-by: Marcus Noble <github@marcusnoble.co.uk>

manifests/_apps/certmanager_chart.yaml

@@ -35,7 +35,7 @@ spec:
     name: cluster-fun (v2)
   source:
     repoURL: 'https://charts.jetstack.io'
-    targetRevision: v1.21.2
+    targetRevision: v1.21.3
     chart: cert-manager
     helm:
       version: v3

manifests/_apps/sre-agent.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: airtrail
+  name: sre-agent
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: airtrail
+    namespace: default
     name: cluster-fun (v2)
   source:
-    path: manifests/airtrail
+    path: manifests/sre-agent
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:

manifests/_apps/vaultwarden.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: vaultwarden
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: vaultwarden
-    name: cluster-fun (v2)
-  source:
-    path: manifests/vaultwarden
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data
-

manifests/airtrail/airtrail.yaml

@@ -1,145 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: airtrail
-  namespace: airtrail
-  labels:
-    app: airtrail
-    app.kubernetes.io/name: airtrail
-  annotations:
-    kube-1password: 2322tcm3p5v6ql7oy2efrn4jse
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-parse: "true"
-type: Opaque
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: airtrail
-  namespace: airtrail
-  labels:
-    app: airtrail
-    app.kubernetes.io/name: airtrail
-  annotations:
-    reloader.stakater.com/match: "true"
-data:
-  ORIGIN: https://airtrail.cluster.fun
-  UPLOAD_LOCATION: /app/uploads
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: airtrail
-  namespace: airtrail
-  labels:
-    app: airtrail
-    app.kubernetes.io/name: airtrail
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: airtrail
-  template:
-    metadata:
-      labels:
-        app: airtrail
-        app.kubernetes.io/name: airtrail
-    spec:
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-      containers:
-      - name: airtrail
-        image: johly/airtrail:v3.12.0
-        imagePullPolicy: IfNotPresent
-        envFrom:
-        - configMapRef:
-            name: airtrail
-        - secretRef:
-            name: airtrail
-        ports:
-        - containerPort: 3000
-          name: web
-        volumeMounts:
-          - mountPath: /app/uploads
-            name: uploads
-        livenessProbe:
-          httpGet:
-            path: /api/ping
-            port: 3000
-          initialDelaySeconds: 5
-          periodSeconds: 30
-        readinessProbe:
-          httpGet:
-            path: /api/ping
-            port: 3000
-          initialDelaySeconds: 5
-          periodSeconds: 10
-        resources:
-          requests:
-            cpu: 100m
-            memory: 150Mi
-          limits:
-            cpu: 200m
-            memory: 300Mi
-      volumes:
-      - name: uploads
-        persistentVolumeClaim:
-          claimName: airtrail-uploads
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: airtrail
-  namespace: airtrail
-  labels:
-    app: airtrail
-    app.kubernetes.io/name: airtrail
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    targetPort: web
-    name: web
-  selector:
-    app: airtrail
----
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: airtrail
-  namespace: airtrail
-  labels:
-    app: airtrail
-    app.kubernetes.io/name: airtrail
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-    nginx.ingress.kubernetes.io/client-body-buffer-size: 25m
-    nginx.ingress.kubernetes.io/proxy-connect-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-next-upstream: "300"
-    nginx.ingress.kubernetes.io/proxy-next-upstream-timeout: "300"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - airtrail.cluster.fun
-    secretName: airtrail-ingress
-  rules:
-  - host: airtrail.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: airtrail
-            port:
-              name: web

manifests/airtrail/pvs.yaml

@@ -1,13 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: airtrail-uploads
-  namespace: airtrail
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: sbs-default-retain
----

manifests/auth-proxy/internal-services.yaml

@@ -83,37 +83,3 @@ spec:
     app: internal-proxy
   type: ClusterIP
 ---
-apiVersion: v1
-kind: Service
-metadata:
-  name: hermes
-  namespace: auth-proxy
-  labels:
-    app: internal-proxy
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: 8080
-  selector:
-    app: internal-proxy
-  type: ClusterIP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: ollama
-  namespace: auth-proxy
-  labels:
-    app: internal-proxy
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: 8080
-  selector:
-    app: internal-proxy
-  type: ClusterIP
----

manifests/auth-proxy/non-auth-ingress.yaml

@@ -18,7 +18,7 @@ spec:
     - ombi.cluster.fun
     - bsky-feeds.cluster.fun
     - ai.cluster.fun
-    - penpot.cluster.fun
+    - hermes-hooks.cluster.fun
     secretName: non-auth-proxy-ingress
   rules:
   - host: hello-world.cluster.fun
@@ -61,7 +61,7 @@ spec:
             name: tailscale-proxy
             port:
               name: non-auth
-  - host: penpot.cluster.fun
+  - host: hermes-hooks.cluster.fun
     http:
       paths:
       - path: /

manifests/auth-proxy/proxy.yaml

@@ -13,11 +13,7 @@ data:
       "loki.auth-proxy.svc": "loki-write.cluster.local",
       "loki.auth-proxy.svc:80": "loki-write.cluster.local",
       "loki-distributed.auth-proxy.svc": "loki-loki.cluster.local",
-      "loki-distributed.auth-proxy.svc:80": "loki-loki.cluster.local",
+      "loki-distributed.auth-proxy.svc:80": "loki-loki.cluster.local"
-      "hermes.auth-proxy.svc": "hermes.cluster.local",
-      "hermes.auth-proxy.svc:80": "hermes.cluster.local",
-      "ollama.auth-proxy.svc": "ollama.cluster.local",
-      "ollama.auth-proxy.svc:11434": "ollama.cluster.local"
     }
 ---
 apiVersion: apps/v1
@@ -50,7 +46,7 @@ spec:
           - 100.100.100.100
       containers:
       - name: proxy
-        image: rg.fr-par.scw.cloud/averagemarcus/proxy:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/proxy:latest@sha256:2a401eec859bf665e75bbb737b3b1709cd1fa74576e4ba8c7daeb63d8b3e8d51
         imagePullPolicy: Always
         env:
         - name: PROXY_DESTINATION
@@ -72,7 +68,7 @@ spec:
           mountPath: /config/
 
       - name: oauth-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.6@sha256:c3415e8660af553f5e18f5d90db050614c02493c0ac6260ac59442f6d9b12048
         args:
         - --cookie-secure=false
         - --provider=oidc

manifests/base64/base64.yaml

@@ -32,7 +32,7 @@ spec:
       priorityClassName: low
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/base64:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/base64:latest@sha256:1ec2b770a5ffe986bdfbf24094ed945191bd7b9dd27a7b3212af92a3dfcea032
         imagePullPolicy: Always
         ports:
         - containerPort: 80

manifests/blackhole/blackhole.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: black-hole
-        image: averagemarcus/black-hole:latest
+        image: averagemarcus/black-hole:latest@sha256:1e9cb8396f67aeb25a9eaaf14b369a53a7b300ae465859f10d9f0f88ef3023e1
         imagePullPolicy: Always
         ports:
         - containerPort: 9090

manifests/blog/blog.yaml

@@ -38,7 +38,7 @@ spec:
                 topologyKey: kubernetes.io/hostname
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/blog:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/blog:latest@sha256:d40aa67a51924a89ad0ac6f7387a63f2f41e9bff7b5e4c6f7675cd43354b0c28
         imagePullPolicy: Always
         ports:
         - containerPort: 8000

manifests/bsky-screenshot/bsky-screenshot.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/bsky-screenshot:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/bsky-screenshot:latest@sha256:0fae863fc3123f73aa6268a125d5bf2c2122c8a3f2aedaf129462e668e56ab23
         imagePullPolicy: Always
         ports:
         - containerPort: 80

manifests/cel-tester/cel-tester.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/cel-tester:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/cel-tester:latest@sha256:caf9044a19fa0e14f92232f68c1fe808249580d33619ea3706ff935bd2853559
         imagePullPolicy: Always
         ports:
         - containerPort: 80

manifests/civo-versions/civo-versions.yaml

@@ -41,7 +41,7 @@ spec:
       priorityClassName: low
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/civo-versions:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/civo-versions:latest@sha256:90585c61b82e124f9179b60fc8231247e3b37cab76fd7c0185aeb4a4276a0ab4
         imagePullPolicy: Always
         ports:
         - containerPort: 8000

manifests/cors-proxy/cors-proxy.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/cors-proxy:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/cors-proxy:latest@sha256:306783c26392f92af7e34d173493b0f8d6fd7623421d16a02fad26857317aeec
         imagePullPolicy: Always
         ports:
         - containerPort: 8000

manifests/dashboard/dashboard.yaml

@@ -81,7 +81,7 @@ spec:
             secretKeyRef:
               key: password
               name: dashboard-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.6@sha256:c3415e8660af553f5e18f5d90db050614c02493c0ac6260ac59442f6d9b12048
         name: oauth-proxy
         ports:
         - containerPort: 8000

manifests/devstats-viewer/devstats-viewer.yaml

@@ -31,7 +31,7 @@ spec:
         - name: docker-config
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/devstats-viewer:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/devstats-viewer:latest@sha256:ecf19a3dd9ecc16f78d0a276aa977a7a8ee17635d5ee68ea86e5ee0a2e1ebe48
         imagePullPolicy: Always
         ports:
         - containerPort: 80

manifests/feed-fetcher/feed-fetcher.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/feed-fetcher:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/feed-fetcher:latest@sha256:fe79408673dda5c73ed05e38cac441cbbbebd264548318f1e4701751c6a32b35
         imagePullPolicy: Always
         ports:
         - containerPort: 8080

manifests/git-sync/git-sync.yaml

@@ -78,7 +78,7 @@ spec:
         spec:
           containers:
           - name: sync
-            image: rg.fr-par.scw.cloud/averagemarcus/git-sync:latest
+            image: rg.fr-par.scw.cloud/averagemarcus/git-sync:latest@sha256:6060f0e77e324179cf6b2136a180ceecbcc64344682154b8848434fd105323e7
             imagePullPolicy: Always
             env:
             - name: GITHUB_TOKEN

manifests/gitea/gitea.yaml

@@ -43,7 +43,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: git
-        image: gitea/gitea:1.27.3
+        image: gitea/gitea:28.3.0@sha256:8967bf9deaf3c5c4adae13519436dc1b20c646ac83fe37ae810c933a1045227d
         env:
         - name: APP_NAME
           value: "Git"
@@ -67,6 +67,8 @@ spec:
           value: arc-green
         - name: ALLOWED_HOST_LIST
           value: "*"
+        - name: EGRESS_MODE
+          value: "lax"
         - name: SECRET_KEY
           valueFrom:
             secretKeyRef:

manifests/goplayground/goplayground.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: x1unix/go-playground:3.0.0
+        image: x1unix/go-playground:3.0.0@sha256:4c4a9bcbc0413faaacc8eb0a425922858a55b73ab03f5359082217d5b93cc000
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 8000

manifests/grist/grist.yaml

@@ -75,7 +75,7 @@ spec:
       priorityClassName: critical
       containers:
         - name: grist
-          image: gristlabs/grist-oss:1.7.19
+          image: gristlabs/grist-oss:1.7.22@sha256:40d2c0ce0c29b2aa1ec1dcf9652ec26a13a8f2b4b44116733bcede428afd27dc
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

manifests/link/link.yaml

@@ -86,7 +86,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/link:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/link:latest@sha256:11d3908c87c91c3e9b0ac64377a016f967eb96d92c5a478f61ac4d6e4b7128f9
         imagePullPolicy: Always
         ports:
         - containerPort: 5050

manifests/marcusnoble/marcusnoble.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/marcusnoble:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/marcusnoble:latest@sha256:258e639003301f9a41a796c74a963b624454de6dad2dd90f0a1eb745027cfc88
         imagePullPolicy: Always
         ports:
         - containerPort: 8080

manifests/mazanoke/manifest.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: ghcr.io/civilblur/mazanoke:v1.1.7
+        image: ghcr.io/civilblur/mazanoke:v1.1.7@sha256:ca83cddd90cd1e4b43102884bf39025731a1c7569f3bbda9d6530de72528cbab
         imagePullPolicy: Always
         ports:
         - containerPort: 80

manifests/mealie/mealie.yaml

@@ -31,7 +31,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: frontend
-        image: ghcr.io/mealie-recipes/mealie:v3.27.0
+        image: ghcr.io/mealie-recipes/mealie:v3.30.0@sha256:90f83da6f3ab0a421efc827118a556168573930105f13fa3321768f42163d784
         imagePullPolicy: Always
         envFrom:
         - secretRef:

manifests/monitoring/cadvisor.yaml

@@ -38,7 +38,7 @@ spec:
           operator: "Exists"
       automountServiceAccountToken: false
       containers:
-      - image: ghcr.io/google/cadvisor:v0.60.6
+      - image: ghcr.io/google/cadvisor:v0.60.6@sha256:b8e7d1093144fd088f425ff003d75a4aa405de075db78dae3bc563730b1bd07a
         name: cadvisor
         ports:
         - containerPort: 8080

manifests/monitoring/ephemeral-storage-exporter.yaml

@@ -78,7 +78,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: metrics
-          image: ghcr.io/jmcgrath207/k8s-ephemeral-storage-metrics:1.21.3
+          image: ghcr.io/jmcgrath207/k8s-ephemeral-storage-metrics:1.21.3@sha256:8297aa4a92787ebda42827be98da6f7a77206f4c8d140858626c97c469997b67
           imagePullPolicy: IfNotPresent
           ports:
             - name: metrics

manifests/monitoring/kube-state-metrics.yaml

@@ -238,7 +238,7 @@ spec:
         - --resources=validatingwebhookconfigurations
         #- --resources=volumeattachments
         imagePullPolicy: IfNotPresent
-        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0"
+        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0@sha256:42cfe3723a5f058171c627537fb57a3ea0f26e4380fa18555a95cb1a1b4cfc5b"
         ports:
         - containerPort: 8080
         livenessProbe:

manifests/monitoring/node-exporter.yaml

@@ -55,7 +55,7 @@ spec:
       serviceAccountName: prometheus-node-exporter
       containers:
         - name: prometheus-node-exporter
-          image: "prom/node-exporter:v1.12.1"
+          image: "prom/node-exporter:v1.12.1@sha256:1b4e4438faca4dd7e001dd445d161a4a2091b0fededa84093b3a8dfeae1f1be0"
           imagePullPolicy: "IfNotPresent"
           args:
             - --path.procfs=/host/proc

manifests/monitoring/promtail.yaml

@@ -216,7 +216,7 @@ spec:
       serviceAccountName: promtail
       containers:
         - name: promtail
-          image: "grafana/promtail:2.9.17"
+          image: "grafana/promtail:2.9.17@sha256:b28495fdab552b183428c5b5cebbf258231fc5f00be7724be2bc091ad21ac390"
           imagePullPolicy: IfNotPresent
           args:
             - "-config.file=/etc/promtail/promtail.yaml"

manifests/monitoring/vmagent.yaml

@@ -217,7 +217,7 @@ spec:
       serviceAccountName: prometheus-server
       containers:
         - name: vmagent
-          image: "victoriametrics/vmagent:v1.152.0"
+          image: "victoriametrics/vmagent:v1.155.0@sha256:8e3c03905be15bba8312d4868e8ae6f9fc2fefee0a41d544472034249ca42bb4"
           imagePullPolicy: "IfNotPresent"
           args:
             - -remoteWrite.url=http://vmcluster.auth-proxy.svc/insert/0/prometheus/

manifests/nextcloud_chart/manifest.yaml

@@ -206,7 +206,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: nextcloud
-        image: "nextcloud:35.0.0-apache"
+        image: "nextcloud:35.0.2-apache@sha256:d88929dc8386420b8963f86cabb667fdaf733eef9dcf8fc98e226801a32c023c"
         imagePullPolicy: IfNotPresent
         env:
         - name: SQLITE_DATABASE
@@ -340,7 +340,7 @@ spec:
           mountPath: /var/www/html/config/smtp.config.php
           subPath: smtp.config.php
       - name: cron
-        image: "nextcloud:35.0.0-apache"
+        image: "nextcloud:35.0.2-apache@sha256:d88929dc8386420b8963f86cabb667fdaf733eef9dcf8fc98e226801a32c023c"
         imagePullPolicy: IfNotPresent
         command:
           - /cron.sh

manifests/nodered/nodered.yaml

@@ -57,7 +57,7 @@ spec:
           - name: data
             mountPath: /data
       - name: update-native-modules
-        image: nodered/node-red:4.1.15-18
+        image: nodered/node-red:4.1.17-18@sha256:161239fa8c3ebc2e6c5c831eb536960d4bdec677c7117a738d89a106cc2755a6
         imagePullPolicy: IfNotPresent
         command:
           - bash
@@ -73,7 +73,7 @@ spec:
             mountPath: /data
       containers:
       - name: web
-        image: nodered/node-red:4.1.15-18
+        image: nodered/node-red:4.1.17-18@sha256:161239fa8c3ebc2e6c5c831eb536960d4bdec677c7117a738d89a106cc2755a6
         imagePullPolicy: Always
         ports:
         - containerPort: 1880

manifests/opengraph/opengraph.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/opengraph-image-gen:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/opengraph-image-gen:latest@sha256:97aea61e4db1e6d441fdfecd28f614b1e5342bfacd3a5ca6021ffca5c03db833
         imagePullPolicy: Always
         ports:
         - containerPort: 3000

manifests/outline/outline.yaml

@@ -46,7 +46,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: outline
-        image: outlinewiki/outline:1.10.1
+        image: outlinewiki/outline:1.12.0@sha256:25d6a2ced2f1f0cf03c09abd776d87ba31941ed96d3a99992aa84b3bd0afc074
         imagePullPolicy: IfNotPresent
         env:
         - name: ALLOWED_DOMAINS

manifests/pairdrop/pairdrop.yaml

@@ -32,7 +32,7 @@ spec:
       priorityClassName: low
       containers:
       - name: web
-        image: ghcr.io/schlagmichdoch/pairdrop:v1.11.2
+        image: ghcr.io/schlagmichdoch/pairdrop:v1.11.2@sha256:c4b30977264a76e335740089e693a52a0d0d616330dec7f93c7b96beef7b4a02
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 3000

manifests/planning-poker/planning-poker.yaml

@@ -62,7 +62,7 @@ spec:
       priorityClassName: critical
       containers:
         - name: planning-poker
-          image: ghcr.io/axeleroy/self-host-planning-poker:1.2.1
+          image: ghcr.io/axeleroy/self-host-planning-poker:1.2.1@sha256:0253f17c07f6c484b6fbef65867863541494e063355d39757ca27963404864d4
           imagePullPolicy: IfNotPresent
           ports:
             - name: web

manifests/qr/qr.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/qr:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/qr:latest@sha256:e98db60ab26d5769bc5b17384fcb10d98e71b353fc23d154d5049fd88bab00eb
         imagePullPolicy: Always
         ports:
         - containerPort: 8080

manifests/redis/redis.yaml

@@ -330,7 +330,7 @@ spec:
       priorityClassName: critical
       containers:
         - name: redis
-          image: docker.io/bitnamilegacy/redis:7.2.4-debian-11-r11
+          image: docker.io/bitnamilegacy/redis:7.2.4-debian-11-r11@sha256:c81b0644726b22fa65669b427610701e86dceb0007438f5d75d271b3197a48bf
           imagePullPolicy: "IfNotPresent"
           securityContext:
             runAsUser: 1001
@@ -472,7 +472,7 @@ spec:
       terminationGracePeriodSeconds: 30
       containers:
         - name: redis
-          image: docker.io/bitnamilegacy/redis:7.2.4-debian-11-r11
+          image: docker.io/bitnamilegacy/redis:7.2.4-debian-11-r11@sha256:c81b0644726b22fa65669b427610701e86dceb0007438f5d75d271b3197a48bf
           imagePullPolicy: "IfNotPresent"
           securityContext:
             runAsUser: 1001

manifests/rss/miniflux.yaml

@@ -68,7 +68,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: ghcr.io/miniflux/miniflux:2.3.3
+        image: ghcr.io/miniflux/miniflux:2.3.5@sha256:8fd6c3c434ecc3d4083306f83e03c0bb74c632e0f8378da5ead7e1773b0b89c9
         imagePullPolicy: IfNotPresent
         envFrom:
         - configMapRef:

manifests/social-to-rolodex/social-to-rolodex.yaml

@@ -92,7 +92,7 @@ spec:
             secretKeyRef:
               key: password
               name: social-to-rolodex-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.6@sha256:c3415e8660af553f5e18f5d90db050614c02493c0ac6260ac59442f6d9b12048
         name: oauth-proxy
         ports:
         - containerPort: 8000

manifests/sre-agent/sre-agent.yaml

@@ -0,0 +1,131 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sre-agent
+  namespace: default
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: sre-agent
+  namespace: default
+  annotations:
+    kubernetes.io/service-account.name: sre-agent
+type: kubernetes.io/service-account-token
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: sre-agent
+  labels:
+    app.kubernetes.io/name: sre-agent
+rules:
+  # Node-level diagnostics
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["nodes/proxy", "nodes/metrics", "nodes/stats"]
+    verbs: ["get", "list"]
+
+  # Pod diagnostics
+  - apiGroups: [""]
+    resources: ["pods", "pods/log", "pods/status", "pods/ephemeralcontainers"]
+    verbs: ["get", "list", "watch"]
+
+  # Services, endpoints, networking
+  - apiGroups: [""]
+    resources: ["services", "endpoints", "endpointslices", "namespaces"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims", "persistentvolumes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["configmaps", "secrets"]
+    verbs: ["get", "list"]    # readable only, no modify/delete
+  - apiGroups: [""]
+    resources: ["resourcequotas", "limitranges"]
+    verbs: ["get", "list"]
+
+  # Network policies
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  # Workloads
+  - apiGroups: ["apps"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments/scale", "replicasets/scale"]
+    verbs: ["get"]
+
+  # Jobs & cronjobs
+  - apiGroups: ["batch"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["batch"]
+    resources: ["jobs/log"]
+    verbs: ["get", "list"]
+
+  # Autoscaling
+  - apiGroups: ["autoscaling"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  # RBAC visibility (diagnose who owns what)
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  # Custom Resource Definitions (so we can inspect custom resources)
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
+
+  # Priority classes
+  - apiGroups: ["scheduling.k8s.io"]
+    resources: ["priorityclasses"]
+    verbs: ["get", "list"]
+
+  # Certificate rotation
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["certificatesigningrequests", "certificatesigningrequests/approval"]
+    verbs: ["get", "list", "watch"]
+
+  # Metrics Server (if installed)
+  - apiGroups: ["metrics.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list"]
+
+  # Admission controllers / pod security (diagnostic)
+  - apiGroups: ["policy"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: sre-agent-binding
+  labels:
+    app.kubernetes.io/name: sre-agent
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: sre-agent
+subjects:
+  - kind: ServiceAccount
+    name: sre-agent
+    namespace: default

manifests/svg-to-dxf/svg-to-dxf.yaml

@@ -30,7 +30,7 @@ spec:
       priorityClassName: low
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/svg-to-dxf:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/svg-to-dxf:latest@sha256:7e74cd6569ed68d46b012ffbd672be9e4c6422b28fb13eb5d83b2c1dc85e9cb9
         imagePullPolicy: Always
         ports:
         - containerPort: 8080

manifests/text-to-dxf/text-to-dxf.yaml

@@ -30,7 +30,7 @@ spec:
       priorityClassName: low
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/text-to-dxf:latest
+        image: rg.fr-par.scw.cloud/averagemarcus/text-to-dxf:latest@sha256:f1ce90feec0dae575979c7fa83b855ced939efe23d749cc2615f5d43a08cacb0
         imagePullPolicy: Always
         ports:
         - containerPort: 8080

manifests/traefik/traefik.yaml

@@ -45,7 +45,7 @@ spec:
         - --entrypoints.websecure.http.tls=true
         - --entrypoints.web.http.redirections.entrypoint.to=websecure
         - --entrypoints.web.http.redirections.entrypoint.scheme=https
-        image: rancher/mirrored-library-traefik:2.11.50
+        image: rancher/mirrored-library-traefik:3.7.17@sha256:321153f6f732f912cf5c6f0597fe38743fc7895d482d7d8804a479ae0403e151
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3

manifests/trek/trek.yaml

@@ -58,7 +58,7 @@ spec:
     spec:
       containers:
       - name: trek
-        image: mauriceboe/trek:4.3.0
+        image: mauriceboe/trek:5.1.0@sha256:23bf3fa6a134dc38a3b4f40ef8f7e8040abc96965105dffdcfcf5f202fb5d0b7
         imagePullPolicy: IfNotPresent
         envFrom:
         - configMapRef:

manifests/url-to-grist/url-to-grist.yaml

@@ -52,7 +52,7 @@ spec:
     spec:
       containers:
       - name: url-to-grist
-        image: ghcr.io/namelessplanet/url-to-grist:v1.6.1
+        image: ghcr.io/namelessplanet/url-to-grist:v1.6.1@sha256:7912e3340b071244d7b807759608c6bc6f8e563f548485379247ef1106a82be5
         imagePullPolicy: IfNotPresent
         env:
         - name: PORT

manifests/vaultwarden/README.md

@@ -1,5 +0,0 @@
-# vaultwarden
-
-Note: There's a catch-22 when deploying this in that the Secrets can't be pulled from Vaultwarden as that are needed _for_ Vaultwarden. These need to be manually populated for this to work.
-
-During migration, secrets are still pulled from 1Password.

manifests/vaultwarden/config.yaml

@@ -1,51 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: vaultwarden-credentials
-  labels:
-    app: vaultwarden
-    app.kubernetes.io/name: vaultwarden
-  annotations:
-    kube-1password: e75k7oktk43v4mmvbs24vyelwy
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-parse: "true"
-type: Opaque
-
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: vaultwarden-smtp
-  labels:
-    app: vaultwarden
-    app.kubernetes.io/name: vaultwarden
-  annotations:
-    kube-1password: 3kiighdh7la4wdfiv5fzgm34yu
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-parse: "true"
-type: Opaque
-
----
-
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: vaultwarden-config
-  labels:
-    app: vaultwarden
-    app.kubernetes.io/name: vaultwarden
-data:
-  DOMAIN: "https://vault.cluster.fun"
-
-  # Signup Controls
-  SIGNUPS_ALLOWED: "false"
-  INVITATIONS_ALLOWED: "true"
-  INVITATION_ORG_NAME: "Noble"
-
-  # Security
-  SHOW_PASSWORD_HINT: "false"
-  EXTENDED_LOGGING: "true"
-  LOG_LEVEL: "info"
-  REQUIRE_DEVICE_EMAIL: "true"
-

manifests/vaultwarden/deployment.yaml

@@ -1,70 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: vaultwarden
-  labels:
-    app: vaultwarden
-    app.kubernetes.io/name: vaultwarden
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: vaultwarden
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: vaultwarden
-        app.kubernetes.io/name: vaultwarden
-    spec:
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            podAffinityTerm:
-              labelSelector:
-                matchExpressions:
-                - key: app.kubernetes.io/name
-                  operator: In
-                  values:
-                  - vaultwarden
-              topologyKey: kubernetes.io/hostname
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: vaultwarden
-          image: vaultwarden/server:1.37.3-alpine
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          envFrom:
-          - configMapRef:
-              name: vaultwarden-config
-          - secretRef:
-              name: vaultwarden-credentials
-          - secretRef:
-              name: vaultwarden-smtp
-          volumeMounts:
-            - name: vaultwarden-data
-              mountPath: /data
-            - name: vaultwarden-attachments
-              mountPath: /data/attachments
-          resources:
-            requests:
-              cpu: "100m"
-              memory: "128Mi"
-      volumes:
-        - name: vaultwarden-data
-          persistentVolumeClaim:
-            claimName: vaultwarden-data
-        - name: vaultwarden-attachments
-          persistentVolumeClaim:
-            claimName: vaultwarden-attachments

manifests/vaultwarden/ingres.yaml

@@ -1,37 +0,0 @@
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: vaultwarden
-  labels:
-    app: vaultwarden
-    app.kubernetes.io/name: vaultwarden
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/ssl-protocols: "TLSv1.2 TLSv1.3"
-    nginx.ingress.kubernetes.io/proxy-body-size: "100m"
-    nginx.ingress.kubernetes.io/client-body-buffer-size: 25m
-    nginx.ingress.kubernetes.io/proxy-connect-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-next-upstream: "300"
-    nginx.ingress.kubernetes.io/proxy-next-upstream-timeout: "300"
-    nginx.ingress.kubernetes.io/limit-rps: "10"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - vault.cluster.fun
-    secretName: vaultwarden-ingress
-  rules:
-  - host: vault.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: vaultwarden
-            port:
-              name: http

manifests/vaultwarden/pv.yaml

@@ -1,29 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: vaultwarden-data
-  labels:
-    app: vaultwarden
-    app.kubernetes.io/name: vaultwarden
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: sbs-default-retain
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: vaultwarden-attachments
-  labels:
-    app: vaultwarden
-    app.kubernetes.io/name: vaultwarden
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: sbs-default-retain

manifests/vaultwarden/service.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: vaultwarden
-  labels:
-    app: vaultwarden
-    app.kubernetes.io/name: vaultwarden
-spec:
-  type: ClusterIP
-  ports:
-    - name: http
-      port: 80
-      targetPort: http
-      protocol: TCP
-  selector:
-    app: vaultwarden

manifests/vert/manifest.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: ghcr.io/vert-sh/vert:sha-438f91a
+        image: ghcr.io/vert-sh/vert:sha-438f91a@sha256:c604d357e44dce6020391b6bd8d20e4f5d35e3778ecf58bbccbd8fdc6792eaf4
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 80

manifests/yay-or-nay/yay-or-nay.yaml

@@ -31,7 +31,7 @@ spec:
     spec:
       containers:
       - name: yay-or-nay
-        image: ghcr.io/mocdaniel/yay-or-nay:1.2.1
+        image: ghcr.io/mocdaniel/yay-or-nay:1.2.1@sha256:3edb37642d749124e9e03a6dbaca9ae5d0a45dd9361a0dbcae1ad051faeb1743
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 3000

renovate.json

@@ -8,7 +8,8 @@
   "rebaseWhen": "behind-base-branch",
   "extends": [
     "replacements:k8s-registry-move",
-    "local>averagemarcus/renovate-config//source-urls"
+    "local>averagemarcus/renovate-config//source-urls",
+    "docker:pinDigests"
   ],
   "ignorePaths": [
     "terraform"
@@ -24,5 +25,11 @@
   },
   "argocd": {
     "managerFilePatterns": ["/manifests/_apps/.+\\.yaml$/"]
+  },
+  "packageRules": [
+    {
+      "matchCurrentValue": "/(latest|full)/",
+      "pinDigests": false
     }
+  ]
 }