Automated Manifest Update (#5120)

This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow.

### Details
- **Trigger**: `pull_request` by `@alexlebens`
- **Commit**: `dcf6944` (on `dcf6944e614c0fa00b6455fc58503ce0b79f7b7b`)
- **Charts Updated**: `code-server,coredns,dawarich`

Reviewed-on: #5120
Co-authored-by: gitea-bot <gitea-bot@alexlebens.net>
Co-committed-by: gitea-bot <gitea-bot@alexlebens.net>

clusters/cl01tl/manifests/code-server/Deployment-code-server.yaml

@@ -29,6 +29,9 @@ spec:
       enableServiceLinks: false
       serviceAccountName: default
       automountServiceAccountToken: true
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
       hostIPC: false
       hostNetwork: false
       hostPID: false
@@ -36,7 +39,7 @@ spec:
       containers:
         - env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
             - name: PUID
               value: "1000"
             - name: PGID
@@ -47,12 +50,11 @@ spec:
             - secretRef:
                 name: codeserver-password-secret
           image: ghcr.io/linuxserver/code-server:4.112.0@sha256:4bb5b8ad22268001687c047f0f04933799fb03df1eb0e1e266ba15ed2d9f4e8b
-          imagePullPolicy: IfNotPresent
           name: main
           resources:
             requests:
               cpu: 10m
-              memory: 128Mi
+              memory: 80Mi
           volumeMounts:
             - mountPath: /config
               name: config

clusters/cl01tl/manifests/code-server/ExternalSecret-codeserver-password-secret.yaml

@@ -14,15 +14,9 @@ spec:
   data:
     - secretKey: PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/code-server/auth
-        metadataPolicy: None
         property: PASSWORD
     - secretKey: SUDO_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/code-server/auth
-        metadataPolicy: None
         property: SUDO_PASSWORD

clusters/cl01tl/manifests/code-server/HTTPRoute-code-server.yaml

@@ -23,7 +23,7 @@ spec:
           name: code-server
           namespace: code-server
           port: 8443
-          weight: 100
+          weight: 1
       matches:
         - path:
             type: PathPrefix

clusters/cl01tl/manifests/code-server/PersistentVolumeClaim-code-server-config.yaml

@@ -7,8 +7,6 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: code-server
     helm.sh/chart: code-server-4.6.2
-  annotations:
-    helm.sh/resource-policy: keep
   namespace: code-server
 spec:
   accessModes:

clusters/cl01tl/manifests/coredns/ConfigMap-coredns.yaml

@@ -34,10 +34,12 @@ data:
     dns://alexlebens.net:53 {
         errors
         cache 30
+        prometheus :9153
         forward . 10.111.232.172
     }
     dns://ts.net:53 {
         errors
         cache 30
+        prometheus :9153
         forward . 10.97.20.219
     }

clusters/cl01tl/manifests/coredns/Deployment-coredns.yaml

@@ -11,7 +11,7 @@ metadata:
     kubernetes.io/cluster-service: "true"
     kubernetes.io/name: "CoreDNS"
     app.kubernetes.io/name: coredns
-    app.kubernetes.io/version: "v1.14.2"
+    app.kubernetes.io/version: "v1.14.2_sha256-e7e6440cfd1e919280958f5b5a6ab2b184d385bba774c12a"
 spec:
   replicas: 3
   strategy:
@@ -31,7 +31,7 @@ spec:
         app.kubernetes.io/name: coredns
         app.kubernetes.io/instance: "coredns"
       annotations:
-        checksum/config: f4a6d6c3e35774362e3a63510747807812b072d700356d5e5fe19ecdf9da07b1
+        checksum/config: 8dba01057be851fa708634bf93eaecce2bd62f631b46a5c007707c1cefd6dce3
         scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
     spec:
       terminationGracePeriodSeconds: 30
@@ -49,19 +49,17 @@ spec:
         kubernetes.io/os: linux
       containers:
         - name: "coredns"
-          image: "registry.k8s.io/coredns/coredns:v1.14.2"
+          image: "registry.k8s.io/coredns/coredns:v1.14.2@sha256:e7e6440cfd1e919280958f5b5a6ab2b184d385bba774c12ad2a9e1e4183f90d9"
           imagePullPolicy: IfNotPresent
           args: ["-conf", "/etc/coredns/Corefile"]
           volumeMounts:
             - name: config-volume
               mountPath: /etc/coredns
           resources:
-            limits:
+            limits: {}
-              cpu: 100m
-              memory: 128Mi
             requests:
-              cpu: 50m
+              cpu: 20m
-              memory: 128Mi
+              memory: 32Mi
           ports:
             - {"containerPort": 53, "name": "udp-53", "protocol": "UDP"}
             - {"containerPort": 53, "name": "tcp-53", "protocol": "TCP"}

clusters/cl01tl/manifests/dawarich/Deployment-dawarich.yaml

@@ -114,13 +114,23 @@ spec:
               value: "true"
             - name: STORE_GEODATA
               value: "true"
-          image: freikin/dawarich:1.4.0
+          image: freikin/dawarich:1.4.0@sha256:07adb7643b00d1d8f606c675931d3604317fa3851b91b74ec503df8d50734cb8
-          imagePullPolicy: IfNotPresent
+          livenessProbe:
+            exec:
+              command:
+                - /bin/sh
+                - -c
+                - wget -qO - http://127.0.0.1:3000/api/v1/health | grep -q '"status"\s*:\s*"ok"'
+            failureThreshold: 5
+            initialDelaySeconds: 60
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 10
           name: main
           resources:
             requests:
               cpu: 10m
-              memory: 128Mi
+              memory: 750Mi
           volumeMounts:
             - mountPath: /var/app/public
               name: public
@@ -205,13 +215,19 @@ spec:
               value: "true"
             - name: STORE_GEODATA
               value: "true"
-          image: freikin/dawarich:1.4.0
+          image: freikin/dawarich:1.4.0@sha256:07adb7643b00d1d8f606c675931d3604317fa3851b91b74ec503df8d50734cb8
-          imagePullPolicy: IfNotPresent
+          livenessProbe:
+            exec:
+              command:
+                - pgrep
+                - -f
+                - sidekiq
+            failureThreshold: 5
+            initialDelaySeconds: 60
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 10
           name: sidekiq
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
           volumeMounts:
             - mountPath: /var/app/public
               name: public

clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-key-secret.yaml

@@ -14,8 +14,5 @@ spec:
   data:
     - secretKey: key
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/dawarich/key
-        metadataPolicy: None
         property: key

clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-oidc-secret.yaml

@@ -14,15 +14,9 @@ spec:
   data:
     - secretKey: client
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/dawarich
-        metadataPolicy: None
         property: client
     - secretKey: secret
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/dawarich
-        metadataPolicy: None
         property: secret

clusters/cl01tl/manifests/dawarich/HTTPRoute-dawarich.yaml

@@ -23,7 +23,7 @@ spec:
           name: dawarich
           namespace: dawarich
           port: 80
-          weight: 100
+          weight: 1
       matches:
         - path:
             type: PathPrefix

clusters/cl01tl/manifests/dawarich/PersistentVolumeClaim-dawarich-public.yaml

@@ -7,8 +7,6 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich
     helm.sh/chart: dawarich-4.6.2
-  annotations:
-    helm.sh/resource-policy: keep
   namespace: dawarich
 spec:
   accessModes:

clusters/cl01tl/manifests/dawarich/PersistentVolumeClaim-dawarich-storage.yaml

@@ -7,8 +7,6 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich
     helm.sh/chart: dawarich-4.6.2
-  annotations:
-    helm.sh/resource-policy: keep
   namespace: dawarich
 spec:
   accessModes:

clusters/cl01tl/manifests/dawarich/PersistentVolumeClaim-dawarich-watched.yaml

@@ -7,8 +7,6 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich
     helm.sh/chart: dawarich-4.6.2
-  annotations:
-    helm.sh/resource-policy: keep
   namespace: dawarich
 spec:
   accessModes: