Update grafana/promtail Docker tag to v3

Signed-off-by: Marcus Noble <github@marcusnoble.co.uk>

manifests/_apps/sre-agent.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: airtrail
+  name: sre-agent
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: airtrail
+    namespace: default
     name: cluster-fun (v2)
   source:
-    path: manifests/airtrail
+    path: manifests/sre-agent
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:

manifests/airtrail/airtrail.yaml

@@ -1,145 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: airtrail
-  namespace: airtrail
-  labels:
-    app: airtrail
-    app.kubernetes.io/name: airtrail
-  annotations:
-    kube-1password: 2322tcm3p5v6ql7oy2efrn4jse
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-parse: "true"
-type: Opaque
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: airtrail
-  namespace: airtrail
-  labels:
-    app: airtrail
-    app.kubernetes.io/name: airtrail
-  annotations:
-    reloader.stakater.com/match: "true"
-data:
-  ORIGIN: https://airtrail.cluster.fun
-  UPLOAD_LOCATION: /app/uploads
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: airtrail
-  namespace: airtrail
-  labels:
-    app: airtrail
-    app.kubernetes.io/name: airtrail
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: airtrail
-  template:
-    metadata:
-      labels:
-        app: airtrail
-        app.kubernetes.io/name: airtrail
-    spec:
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-      containers:
-      - name: airtrail
-        image: johly/airtrail:v3.13.1@sha256:800466d42393a0a9f360a93d98ab8da524381b19f3c06cd4552c27106d982e3d
-        imagePullPolicy: IfNotPresent
-        envFrom:
-        - configMapRef:
-            name: airtrail
-        - secretRef:
-            name: airtrail
-        ports:
-        - containerPort: 3000
-          name: web
-        volumeMounts:
-          - mountPath: /app/uploads
-            name: uploads
-        livenessProbe:
-          httpGet:
-            path: /api/ping
-            port: 3000
-          initialDelaySeconds: 5
-          periodSeconds: 30
-        readinessProbe:
-          httpGet:
-            path: /api/ping
-            port: 3000
-          initialDelaySeconds: 5
-          periodSeconds: 10
-        resources:
-          requests:
-            cpu: 100m
-            memory: 150Mi
-          limits:
-            cpu: 200m
-            memory: 300Mi
-      volumes:
-      - name: uploads
-        persistentVolumeClaim:
-          claimName: airtrail-uploads
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: airtrail
-  namespace: airtrail
-  labels:
-    app: airtrail
-    app.kubernetes.io/name: airtrail
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    targetPort: web
-    name: web
-  selector:
-    app: airtrail
----
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: airtrail
-  namespace: airtrail
-  labels:
-    app: airtrail
-    app.kubernetes.io/name: airtrail
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-    nginx.ingress.kubernetes.io/client-body-buffer-size: 25m
-    nginx.ingress.kubernetes.io/proxy-connect-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-next-upstream: "300"
-    nginx.ingress.kubernetes.io/proxy-next-upstream-timeout: "300"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - airtrail.cluster.fun
-    secretName: airtrail-ingress
-  rules:
-  - host: airtrail.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: airtrail
-            port:
-              name: web

manifests/airtrail/pvs.yaml

@@ -1,13 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: airtrail-uploads
-  namespace: airtrail
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: sbs-default-retain
----

manifests/auth-proxy/proxy.yaml

@@ -68,7 +68,7 @@ spec:
           mountPath: /config/
 
       - name: oauth-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.5@sha256:8498b0d0ef0a7b29686414000a08aee467f02d0299c9ed1e006a8f33fc017916
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.6@sha256:c3415e8660af553f5e18f5d90db050614c02493c0ac6260ac59442f6d9b12048
         args:
         - --cookie-secure=false
         - --provider=oidc

manifests/dashboard/dashboard.yaml

@@ -81,7 +81,7 @@ spec:
             secretKeyRef:
               key: password
               name: dashboard-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.5@sha256:8498b0d0ef0a7b29686414000a08aee467f02d0299c9ed1e006a8f33fc017916
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.6@sha256:c3415e8660af553f5e18f5d90db050614c02493c0ac6260ac59442f6d9b12048
         name: oauth-proxy
         ports:
         - containerPort: 8000

manifests/gitea/gitea.yaml

@@ -43,7 +43,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: git
-        image: gitea/gitea:28.2.0@sha256:30777c91280d973fa02be48b1ade735bd6859e8f6f7af3b4444d519437852504
+        image: gitea/gitea:28.3.0@sha256:8967bf9deaf3c5c4adae13519436dc1b20c646ac83fe37ae810c933a1045227d
         env:
         - name: APP_NAME
           value: "Git"

manifests/grist/grist.yaml

@@ -75,7 +75,7 @@ spec:
       priorityClassName: critical
       containers:
         - name: grist
-          image: gristlabs/grist-oss:1.7.21@sha256:5657dc14b1745ef759bf789e5206ff4591e9b7d61d53777cc2fc710bfc9fbe36
+          image: gristlabs/grist-oss:1.7.22@sha256:40d2c0ce0c29b2aa1ec1dcf9652ec26a13a8f2b4b44116733bcede428afd27dc
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

manifests/mealie/mealie.yaml

@@ -31,7 +31,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: frontend
-        image: ghcr.io/mealie-recipes/mealie:v3.29.0@sha256:78eb28b8776d0bad40c5e605c72b3f4f5976793e491558c7dcbdfc04c835d4bc
+        image: ghcr.io/mealie-recipes/mealie:v3.30.0@sha256:90f83da6f3ab0a421efc827118a556168573930105f13fa3321768f42163d784
         imagePullPolicy: Always
         envFrom:
         - secretRef:

manifests/monitoring/promtail.yaml

@@ -216,7 +216,7 @@ spec:
       serviceAccountName: promtail
       containers:
         - name: promtail
-          image: "grafana/promtail:2.9.17@sha256:b28495fdab552b183428c5b5cebbf258231fc5f00be7724be2bc091ad21ac390"
+          image: "grafana/promtail:3.6.11@sha256:a761cb834cfaeee29745440d4884d6748f0a08d8f68928db1d707018c1dcfbe9"
           imagePullPolicy: IfNotPresent
           args:
             - "-config.file=/etc/promtail/promtail.yaml"

manifests/nextcloud_chart/manifest.yaml

@@ -206,7 +206,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: nextcloud
-        image: "nextcloud:35.0.2-apache@sha256:89af7ee7a96ff5e9668280566209268ae6b2d02327f6ef6d56f6d68228cf9431"
+        image: "nextcloud:35.0.2-apache@sha256:d88929dc8386420b8963f86cabb667fdaf733eef9dcf8fc98e226801a32c023c"
         imagePullPolicy: IfNotPresent
         env:
         - name: SQLITE_DATABASE
@@ -340,7 +340,7 @@ spec:
           mountPath: /var/www/html/config/smtp.config.php
           subPath: smtp.config.php
       - name: cron
-        image: "nextcloud:35.0.2-apache@sha256:89af7ee7a96ff5e9668280566209268ae6b2d02327f6ef6d56f6d68228cf9431"
+        image: "nextcloud:35.0.2-apache@sha256:d88929dc8386420b8963f86cabb667fdaf733eef9dcf8fc98e226801a32c023c"
         imagePullPolicy: IfNotPresent
         command:
           - /cron.sh

manifests/nodered/nodered.yaml

@@ -44,7 +44,7 @@ spec:
         fsGroup: 1000
       initContainers:
       - name: config-copy
-        image: bash:latest@sha256:ab2ada570d744f42f517986fdd3c81ef60fe2054ed0c5295a7922e3b0ccd1b02
+        image: bash:latest
         imagePullPolicy: IfNotPresent
         args:
           - -c

manifests/rss/miniflux.yaml

@@ -68,7 +68,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: ghcr.io/miniflux/miniflux:2.3.4@sha256:72e49f513a63104506aab98ba8cfc3a409d4fde23550a583dec07ec941f1e94e
+        image: ghcr.io/miniflux/miniflux:2.3.5@sha256:8fd6c3c434ecc3d4083306f83e03c0bb74c632e0f8378da5ead7e1773b0b89c9
         imagePullPolicy: IfNotPresent
         envFrom:
         - configMapRef:

manifests/social-to-rolodex/social-to-rolodex.yaml

@@ -92,7 +92,7 @@ spec:
             secretKeyRef:
               key: password
               name: social-to-rolodex-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.5@sha256:8498b0d0ef0a7b29686414000a08aee467f02d0299c9ed1e006a8f33fc017916
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.6@sha256:c3415e8660af553f5e18f5d90db050614c02493c0ac6260ac59442f6d9b12048
         name: oauth-proxy
         ports:
         - containerPort: 8000

manifests/sre-agent/sre-agent.yaml

@@ -0,0 +1,131 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sre-agent
+  namespace: default
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: sre-agent
+  namespace: default
+  annotations:
+    kubernetes.io/service-account.name: sre-agent
+type: kubernetes.io/service-account-token
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: sre-agent
+  labels:
+    app.kubernetes.io/name: sre-agent
+rules:
+  # Node-level diagnostics
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["nodes/proxy", "nodes/metrics", "nodes/stats"]
+    verbs: ["get", "list"]
+
+  # Pod diagnostics
+  - apiGroups: [""]
+    resources: ["pods", "pods/log", "pods/status", "pods/ephemeralcontainers"]
+    verbs: ["get", "list", "watch"]
+
+  # Services, endpoints, networking
+  - apiGroups: [""]
+    resources: ["services", "endpoints", "endpointslices", "namespaces"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims", "persistentvolumes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["configmaps", "secrets"]
+    verbs: ["get", "list"]    # readable only, no modify/delete
+  - apiGroups: [""]
+    resources: ["resourcequotas", "limitranges"]
+    verbs: ["get", "list"]
+
+  # Network policies
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  # Workloads
+  - apiGroups: ["apps"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments/scale", "replicasets/scale"]
+    verbs: ["get"]
+
+  # Jobs & cronjobs
+  - apiGroups: ["batch"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["batch"]
+    resources: ["jobs/log"]
+    verbs: ["get", "list"]
+
+  # Autoscaling
+  - apiGroups: ["autoscaling"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  # RBAC visibility (diagnose who owns what)
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  # Custom Resource Definitions (so we can inspect custom resources)
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
+
+  # Priority classes
+  - apiGroups: ["scheduling.k8s.io"]
+    resources: ["priorityclasses"]
+    verbs: ["get", "list"]
+
+  # Certificate rotation
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["certificatesigningrequests", "certificatesigningrequests/approval"]
+    verbs: ["get", "list", "watch"]
+
+  # Metrics Server (if installed)
+  - apiGroups: ["metrics.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list"]
+
+  # Admission controllers / pod security (diagnostic)
+  - apiGroups: ["policy"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: sre-agent-binding
+  labels:
+    app.kubernetes.io/name: sre-agent
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: sre-agent
+subjects:
+  - kind: ServiceAccount
+    name: sre-agent
+    namespace: default

manifests/trek/trek.yaml

@@ -58,7 +58,7 @@ spec:
     spec:
       containers:
       - name: trek
-        image: mauriceboe/trek:5.0.0@sha256:0c0a8f5b488fc2967248695e04bb000bb177d0b63d3385089d33dca6fde4daf9
+        image: mauriceboe/trek:5.1.0@sha256:23bf3fa6a134dc38a3b4f40ef8f7e8040abc96965105dffdcfcf5f202fb5d0b7
         imagePullPolicy: IfNotPresent
         envFrom:
         - configMapRef:

renovate.json

@@ -25,5 +25,11 @@
   },
   "argocd": {
     "managerFilePatterns": ["/manifests/_apps/.+\\.yaml$/"]
+  },
+  "packageRules": [
+    {
+      "matchCurrentValue": "/(latest|full)/",
+      "pinDigests": false
     }
+  ]
 }