Merge pull request 'Automated Manifest Update' (#6611) from auto/update-manifests into manifests

Reviewed-on: #6611

clusters/cl01tl/manifests/harbor/ConfigMap-harbor-core.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 data:
   app.conf: |
     appname = Harbor

clusters/cl01tl/manifests/harbor/ConfigMap-harbor-exporter-env.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 data:
   HTTP_PROXY: ""
   HTTPS_PROXY: ""

clusters/cl01tl/manifests/harbor/ConfigMap-harbor-jobservice-env.yaml

@@ -12,13 +12,14 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 data:
   CORE_URL: "http://harbor-core:80"
   TOKEN_SERVICE_URL: "http://harbor-core:80/service/token"
   REGISTRY_URL: "http://harbor-registry:5000"
   REGISTRY_CONTROLLER_URL: "http://harbor-registry:8080"
   REGISTRY_CREDENTIAL_USERNAME: "harbor_registry_user"
+  REGISTRY_HTTP_CLIENT_TIMEOUT: "30"
   JOBSERVICE_WEBHOOK_JOB_MAX_RETRY: "3"
   JOBSERVICE_WEBHOOK_JOB_HTTP_CLIENT_TIMEOUT: "3"
   LOG_LEVEL: "info"

clusters/cl01tl/manifests/harbor/ConfigMap-harbor-jobservice.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 data:
   config.yml: |
     #Server listening port

clusters/cl01tl/manifests/harbor/ConfigMap-harbor-portal.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 data:
   nginx.conf: |
     worker_processes auto;

clusters/cl01tl/manifests/harbor/ConfigMap-harbor-registry.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 data:
   config.yml: |
     version: 0.1
@@ -38,6 +38,8 @@ data:
     redis:
       addr: harbor-valkey.harbor:6379
       db: 2
+      username: ""
+      password: ""
       readtimeout: 10s
       writetimeout: 10s
       dialtimeout: 10s

clusters/cl01tl/manifests/harbor/ConfigMap-harbor-registryctl.yaml

@@ -12,5 +12,5 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 data:

clusters/cl01tl/manifests/harbor/Deployment-harbor-core.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
     component: core
     app.kubernetes.io/component: core
 spec:
@@ -34,13 +34,13 @@ spec:
         app.kubernetes.io/name: harbor
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: harbor
-        app.kubernetes.io/version: "2.14.3"
+        app.kubernetes.io/version: "2.15.0"
         component: core
         app.kubernetes.io/component: core
       annotations:
-        checksum/configmap: 641bbb72f9900d6197857c2f9fb6f0bdc95af2a2e3883dfec940c519b299da5d
+        checksum/configmap: 3a3a6fd7af975efc25037ad550cb4d2cf4ce9f4578a7833e1b9186631fcb7675
-        checksum/secret: 59669814fb7baa809e9428f8ded55a9bf9281f6bfedaa638b53b49cff7b66e22
+        checksum/secret: 7d184289f51bc7b1001e976c80693ff24befaa3ccfb2146ab9c4051b61ae385d
-        checksum/secret-jobservice: f3a0135630d8fa98235c6c6341ee8e42262bad005727f86ce3f0a0679271f1ed
+        checksum/secret-jobservice: 388df16a5ce670284aaa57126ada65df238ddadbad14c5aaa94a384592da2e7d
     spec:
       securityContext:
         runAsUser: 10000
@@ -56,23 +56,31 @@ spec:
               path: /api/v2.0/ping
               scheme: HTTP
               port: 8080
-            failureThreshold: 360
             initialDelaySeconds: 10
             periodSeconds: 10
+            timeoutSeconds: 1
+            failureThreshold: 360
+            successThreshold: 1
           livenessProbe:
             httpGet:
               path: /api/v2.0/ping
               scheme: HTTP
               port: 8080
-            failureThreshold: 2
+            initialDelaySeconds: 0
             periodSeconds: 10
+            timeoutSeconds: 1
+            failureThreshold: 2
+            successThreshold: 1
           readinessProbe:
             httpGet:
               path: /api/v2.0/ping
               scheme: HTTP
               port: 8080
-            failureThreshold: 2
+            initialDelaySeconds: 0
             periodSeconds: 10
+            timeoutSeconds: 1
+            failureThreshold: 2
+            successThreshold: 1
           envFrom:
             - configMapRef:
                 name: "harbor-core"

clusters/cl01tl/manifests/harbor/Deployment-harbor-exporter.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
     component: exporter
     app.kubernetes.io/component: exporter
 spec:
@@ -34,12 +34,12 @@ spec:
         app.kubernetes.io/name: harbor
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: harbor
-        app.kubernetes.io/version: "2.14.3"
+        app.kubernetes.io/version: "2.15.0"
         component: exporter
         app.kubernetes.io/component: exporter
       annotations:
-        checksum/configmap: 5293f455659091cb2f6ed1113095a6dbb04f8364748670cb5d4630ca689d73d8
+        checksum/configmap: 7372b983a0a8b4f12b5b575ae3ea42a3669d01e3ed5d686d06b2158efb15e6fa
-        checksum/secret: bb03df1fde79526e9aaa86ec987c17ba77e4b5cbeb4ff140100971d53b061347
+        checksum/secret: 13d97bf97fd83b77a4d56b8e57acad70773ef1536f9c7a48cf7be1c8b7d13b2c
     spec:
       securityContext:
         runAsUser: 10000
@@ -55,12 +55,18 @@ spec:
               port: 8001
             initialDelaySeconds: 300
             periodSeconds: 10
+            timeoutSeconds: 1
+            failureThreshold: 3
+            successThreshold: 1
           readinessProbe:
             httpGet:
               path: /
               port: 8001
             initialDelaySeconds: 30
             periodSeconds: 10
+            timeoutSeconds: 1
+            failureThreshold: 3
+            successThreshold: 1
           args: ["-log-level", "info"]
           envFrom:
             - configMapRef:

clusters/cl01tl/manifests/harbor/Deployment-harbor-jobservice.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
     component: jobservice
     app.kubernetes.io/component: jobservice
 spec:
@@ -37,14 +37,14 @@ spec:
         app.kubernetes.io/name: harbor
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: harbor
-        app.kubernetes.io/version: "2.14.3"
+        app.kubernetes.io/version: "2.15.0"
         component: jobservice
         app.kubernetes.io/component: jobservice
       annotations:
-        checksum/configmap: fd35a180d4111bc06151e7a8a1b824387e09f2aae58e69ecea24f8540abaebbd
+        checksum/configmap: c2e3acfc6b31142f56cc1bd707f88de87d958699fa1e249938969caacea88422
-        checksum/configmap-env: e01b3437c4423c0fbcfcb609680c3186f3a09d00297883f6b19f117a44d2a88c
+        checksum/configmap-env: 0e296f95cba8dcfaade3244867012fda805351519d0b7e05982b482304838439
-        checksum/secret: f3a0135630d8fa98235c6c6341ee8e42262bad005727f86ce3f0a0679271f1ed
+        checksum/secret: 388df16a5ce670284aaa57126ada65df238ddadbad14c5aaa94a384592da2e7d
-        checksum/secret-core: 59669814fb7baa809e9428f8ded55a9bf9281f6bfedaa638b53b49cff7b66e22
+        checksum/secret-core: 7d184289f51bc7b1001e976c80693ff24befaa3ccfb2146ab9c4051b61ae385d
     spec:
       securityContext:
         runAsUser: 10000
@@ -62,6 +62,9 @@ spec:
               port: 8080
             initialDelaySeconds: 300
             periodSeconds: 10
+            timeoutSeconds: 1
+            failureThreshold: 3
+            successThreshold: 1
           readinessProbe:
             httpGet:
               path: /api/v1/stats
@@ -69,6 +72,9 @@ spec:
               port: 8080
             initialDelaySeconds: 20
             periodSeconds: 10
+            timeoutSeconds: 1
+            failureThreshold: 3
+            successThreshold: 1
           env:
             - name: CORE_SECRET
               valueFrom:

clusters/cl01tl/manifests/harbor/Deployment-harbor-portal.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
     component: portal
     app.kubernetes.io/component: portal
 spec:
@@ -34,11 +34,11 @@ spec:
         app.kubernetes.io/name: harbor
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: harbor
-        app.kubernetes.io/version: "2.14.3"
+        app.kubernetes.io/version: "2.15.0"
         component: portal
         app.kubernetes.io/component: portal
       annotations:
-        checksum/configmap: 67a5d24a4be2482eaeeeb0b460a525257bcc917634227bef22888ba007496c12
+        checksum/configmap: ac3500199b3dbf96a8549550fa6466a04efb316fdedf03997b574152c6f3a096
     spec:
       securityContext:
         runAsUser: 10000
@@ -64,6 +64,9 @@ spec:
               port: 8080
             initialDelaySeconds: 300
             periodSeconds: 10
+            timeoutSeconds: 1
+            failureThreshold: 3
+            successThreshold: 1
           readinessProbe:
             httpGet:
               path: /
@@ -71,6 +74,9 @@ spec:
               port: 8080
             initialDelaySeconds: 1
             periodSeconds: 10
+            timeoutSeconds: 1
+            failureThreshold: 3
+            successThreshold: 1
           ports:
             - containerPort: 8080
           volumeMounts:

clusters/cl01tl/manifests/harbor/Deployment-harbor-registry.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
     component: registry
     app.kubernetes.io/component: registry
 spec:
@@ -37,14 +37,14 @@ spec:
         app.kubernetes.io/name: harbor
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: harbor
-        app.kubernetes.io/version: "2.14.3"
+        app.kubernetes.io/version: "2.15.0"
         component: registry
         app.kubernetes.io/component: registry
       annotations:
-        checksum/configmap: 77823f5f18ace686e7928407a3f045ee24ae0a3bd616a88a110e4a504b03f7ca
+        checksum/configmap: 2e9fbee4c76df88822f47066eb1e8c02cec9917d54a619344512e042d1aba13b
-        checksum/secret: 47a7c4b7d3c8e57c96d426d6085e3d3c9dfed0b5590c1c5a46f3ea642e876775
+        checksum/secret: 0e6f4d074dceb03e699f84fb97a8bb6f2eb9968ee89396d3b9fe56c965d2e5b3
-        checksum/secret-jobservice: f3a0135630d8fa98235c6c6341ee8e42262bad005727f86ce3f0a0679271f1ed
+        checksum/secret-jobservice: 388df16a5ce670284aaa57126ada65df238ddadbad14c5aaa94a384592da2e7d
-        checksum/secret-core: 59669814fb7baa809e9428f8ded55a9bf9281f6bfedaa638b53b49cff7b66e22
+        checksum/secret-core: 7d184289f51bc7b1001e976c80693ff24befaa3ccfb2146ab9c4051b61ae385d
     spec:
       securityContext:
         runAsUser: 10000
@@ -63,6 +63,9 @@ spec:
               port: 5000
             initialDelaySeconds: 300
             periodSeconds: 10
+            timeoutSeconds: 1
+            failureThreshold: 3
+            successThreshold: 1
           readinessProbe:
             httpGet:
               path: /
@@ -70,6 +73,9 @@ spec:
               port: 5000
             initialDelaySeconds: 1
             periodSeconds: 10
+            timeoutSeconds: 1
+            failureThreshold: 3
+            successThreshold: 1
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:
@@ -111,6 +117,9 @@ spec:
               port: 8080
             initialDelaySeconds: 300
             periodSeconds: 10
+            timeoutSeconds: 1
+            failureThreshold: 3
+            successThreshold: 1
           readinessProbe:
             httpGet:
               path: /api/health
@@ -118,6 +127,9 @@ spec:
               port: 8080
             initialDelaySeconds: 1
             periodSeconds: 10
+            timeoutSeconds: 1
+            failureThreshold: 3
+            successThreshold: 1
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:

clusters/cl01tl/manifests/harbor/HTTPRoute-harbor-route.yaml

@@ -28,6 +28,9 @@ spec:
       backendRefs:
         - name: harbor-core
           namespace: "harbor"
+          group: ""
+          kind: Service
+          weight: 1
           port: 80
     - matches:
         - path:
@@ -36,4 +39,7 @@ spec:
       backendRefs:
         - name: harbor-portal
           namespace: "harbor"
+          group: ""
+          kind: Service
+          weight: 1
           port: 80

clusters/cl01tl/manifests/harbor/Job-migration-job.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
     component: migrator
   annotations:
     "helm.sh/hook": pre-upgrade

clusters/cl01tl/manifests/harbor/PersistentVolumeClaim-harbor-registry.yaml

@@ -14,7 +14,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
     component: registry
     app.kubernetes.io/component: registry
 spec:

clusters/cl01tl/manifests/harbor/Secret-harbor-core.yaml

@@ -12,6 +12,6 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 type: Opaque
 data:

clusters/cl01tl/manifests/harbor/Secret-harbor-exporter.yaml

@@ -12,6 +12,6 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 type: Opaque
 data:

clusters/cl01tl/manifests/harbor/Secret-harbor-jobservice.yaml

@@ -12,6 +12,6 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 type: Opaque
 data:

clusters/cl01tl/manifests/harbor/Secret-harbor-registry.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 type: Opaque
 data:
   REGISTRY_REDIS_PASSWORD: ""

clusters/cl01tl/manifests/harbor/Secret-harbor-registryctl.yaml

@@ -12,6 +12,6 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 type: Opaque
 data:

clusters/cl01tl/manifests/harbor/Secret-harbor-trivy.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 type: Opaque
 data:
   redisURL: cmVkaXM6Ly9oYXJib3ItdmFsa2V5LmhhcmJvcjo2Mzc5LzU/aWRsZV90aW1lb3V0X3NlY29uZHM9MzA=

clusters/cl01tl/manifests/harbor/Service-harbor-core.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 spec:
   ports:
     - name: http-web

clusters/cl01tl/manifests/harbor/Service-harbor-exporter.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 spec:
   ports:
     - name: http-metrics

clusters/cl01tl/manifests/harbor/Service-harbor-jobservice.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 spec:
   ports:
     - name: http-jobservice

clusters/cl01tl/manifests/harbor/Service-harbor-portal.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 spec:
   ports:
     - port: 80

clusters/cl01tl/manifests/harbor/Service-harbor-registry.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 spec:
   ports:
     - name: http-registry

clusters/cl01tl/manifests/harbor/Service-harbor-trivy.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 spec:
   ports:
     - name: http-trivy

clusters/cl01tl/manifests/harbor/ServiceMonitor-harbor.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
 spec:
   jobLabel: app.kubernetes.io/name
   endpoints:

clusters/cl01tl/manifests/harbor/StatefulSet-harbor-trivy.yaml

@@ -12,7 +12,7 @@ metadata:
     app.kubernetes.io/name: harbor
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "2.14.3"
+    app.kubernetes.io/version: "2.15.0"
     component: trivy
     app.kubernetes.io/component: trivy
 spec:
@@ -34,11 +34,11 @@ spec:
         app.kubernetes.io/name: harbor
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: harbor
-        app.kubernetes.io/version: "2.14.3"
+        app.kubernetes.io/version: "2.15.0"
         component: trivy
         app.kubernetes.io/component: trivy
       annotations:
-        checksum/secret: 83fe4ce46bcdf24dffaccbf9ece506a58ee9eda2fe07e0aa3658386702fd3d26
+        checksum/secret: a5d88861174c66ea8756756d591713c04dccb4a2d452cf81d4666281915bbf62
     spec:
       securityContext:
         runAsUser: 10000
@@ -131,8 +131,9 @@ spec:
               port: api-server
             initialDelaySeconds: 5
             periodSeconds: 10
-            successThreshold: 1
+            timeoutSeconds: 1
             failureThreshold: 10
+            successThreshold: 1
           readinessProbe:
             httpGet:
               scheme: HTTP
@@ -140,8 +141,9 @@ spec:
               port: api-server
             initialDelaySeconds: 5
             periodSeconds: 10
-            successThreshold: 1
+            timeoutSeconds: 1
             failureThreshold: 3
+            successThreshold: 1
           resources:
             limits:
               cpu: 1

clusters/cl01tl/manifests/traefik/ClusterRole-traefik-traefik.yaml

@@ -5,7 +5,7 @@ metadata:
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-traefik
-    helm.sh/chart: traefik-39.0.9
+    helm.sh/chart: traefik-40.0.0
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -69,10 +69,7 @@ rules:
       - ""
     resources:
       - namespaces
-      - secrets
-      - configmaps
     verbs:
-      - get
       - list
       - watch
   - apiGroups:

clusters/cl01tl/manifests/traefik/ClusterRoleBinding-traefik-traefik.yaml

@@ -5,7 +5,7 @@ metadata:
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-traefik
-    helm.sh/chart: traefik-39.0.9
+    helm.sh/chart: traefik-40.0.0
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io

clusters/cl01tl/manifests/traefik/CustomResourceDefinition-apiauths.hub.traefik.io.yaml

@@ -40,8 +40,31 @@ spec:
               properties:
                 apiKey:
                   description: APIKey configures API key authentication.
+                  properties:
+                    keySource:
+                      description: |-
+                        KeySource defines where to extract the API key from requests.
+                        When not specified, defaults to "Authorization" header with "Bearer" scheme and "api_key" query parameter.
+                        When specified, it completely overrides defaults - fields left empty will disable that extraction method.
+                      minProperties: 1
+                      properties:
+                        header:
+                          description: Header is the name of the header containing the API key.
+                          type: string
+                        headerAuthScheme:
+                          description: |-
+                            HeaderAuthScheme is the authentication scheme prefix in the header value.
+                            The scheme is used to parse headers in the format "<scheme> <token>".
+                            Only applies when header is "Authorization".
+                          type: string
+                        query:
+                          description: Query is the name of the query parameter containing the API key.
+                          type: string
+                      type: object
+                      x-kubernetes-validations:
+                        - message: headerAuthScheme can only be used when header is 'Authorization'
+                          rule: '!has(self.headerAuthScheme) || self.header == ''Authorization'''
                   type: object
-                  x-kubernetes-preserve-unknown-fields: true
                 isDefault:
                   description: |-
                     IsDefault specifies if this APIAuth should be used as the default API authentication method for the namespace.
@@ -69,6 +92,7 @@ spec:
                       description: |-
                         JWKSURL is the URL to fetch the JWKS for JWT verification.
                         Mutually exclusive with SigningSecretName, PublicKey, JWKSFile, and TrustedIssuers.
+
                         Deprecated: Use TrustedIssuers instead for more flexible JWKS configuration with issuer validation.
                       type: string
                       x-kubernetes-validations:

clusters/cl01tl/manifests/traefik/CustomResourceDefinition-apis.hub.traefik.io.yaml

@@ -184,6 +184,11 @@ spec:
                       x-kubernetes-validations:
                         - message: must be a valid URL
                           rule: isURL(self)
+                    validateRequestBodySchema:
+                      description: |-
+                        ValidateRequestBodySchema validates the request body against the OpenAPI specification.
+                        This option overrides the default behavior configured in the static configuration.
+                      type: boolean
                     validateRequestMethodAndPath:
                       description: |-
                         ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.

clusters/cl01tl/manifests/traefik/CustomResourceDefinition-apiversions.hub.traefik.io.yaml

@@ -188,6 +188,11 @@ spec:
                       x-kubernetes-validations:
                         - message: must be a valid URL
                           rule: isURL(self)
+                    validateRequestBodySchema:
+                      description: |-
+                        ValidateRequestBodySchema validates the request body against the OpenAPI specification.
+                        This option overrides the default behavior configured in the static configuration.
+                      type: boolean
                     validateRequestMethodAndPath:
                       description: |-
                         ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.

clusters/cl01tl/manifests/traefik/CustomResourceDefinition-contentitems.hub.traefik.io.yaml

@@ -0,0 +1,164 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: contentitems.hub.traefik.io
+spec:
+  group: hub.traefik.io
+  names:
+    kind: ContentItem
+    listKind: ContentItemList
+    plural: contentitems
+    singular: contentitem
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: ContentItem defines additional documentation for given resource.
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: Defines the documentation to attach to the referenced resource.
+              properties:
+                content:
+                  description: Content is the valid markdown content.
+                  maxLength: 1500000
+                  type: string
+                link:
+                  description: Link is the link to the content.
+                  properties:
+                    href:
+                      description: Href is the public URL of the content.
+                      type: string
+                      x-kubernetes-validations:
+                        - message: must be a valid URL
+                          rule: isURL(self)
+                  required:
+                    - href
+                  type: object
+                order:
+                  description: Order defines the order of the content in the UI.
+                  format: int32
+                  minimum: 0
+                  type: integer
+                parentRef:
+                  description: ParentRef is the reference to the resource that this content belongs to.
+                  properties:
+                    kind:
+                      description: Kind is the kind of the resource that this content belongs to.
+                      enum:
+                        - APIPortal
+                        - API
+                        - APIBundle
+                      type: string
+                    name:
+                      description: Name is the name of the resource that this content belongs to.
+                      maxLength: 253
+                      type: string
+                  required:
+                    - kind
+                    - name
+                  type: object
+                title:
+                  description: Title is the public-facing name of the ContentItem.
+                  maxLength: 253
+                  minLength: 1
+                  type: string
+              required:
+                - order
+                - parentRef
+                - title
+              type: object
+              x-kubernetes-validations:
+                - message: exactly one of content or link must be specified
+                  rule: '[has(self.content), has(self.link)].filter(x, x).size() == 1'
+            status:
+              description: The current status of this ContentItem.
+              properties:
+                conditions:
+                  items:
+                    description: Condition contains details for one aspect of the current state of this API Resource.
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          lastTransitionTime is the last time the condition transitioned from one status to another.
+                          This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                        format: date-time
+                        type: string
+                      message:
+                        description: |-
+                          message is a human readable message indicating details about the transition.
+                          This may be an empty string.
+                        maxLength: 32768
+                        type: string
+                      observedGeneration:
+                        description: |-
+                          observedGeneration represents the .metadata.generation that the condition was set based upon.
+                          For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                          with respect to the current state of the instance.
+                        format: int64
+                        minimum: 0
+                        type: integer
+                      reason:
+                        description: |-
+                          reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                          Producers of specific condition types may define expected values and meanings for this field,
+                          and whether the values are considered a guaranteed API.
+                          The value should be a CamelCase string.
+                          This field may not be empty.
+                        maxLength: 1024
+                        minLength: 1
+                        pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                        type: string
+                      status:
+                        description: status of the condition, one of True, False, Unknown.
+                        enum:
+                          - "True"
+                          - "False"
+                          - Unknown
+                        type: string
+                      type:
+                        description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        maxLength: 316
+                        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                        type: string
+                    required:
+                      - lastTransitionTime
+                      - message
+                      - reason
+                      - status
+                      - type
+                    type: object
+                  type: array
+                hash:
+                  description: Hash is a hash representing the ContentItem.
+                  type: string
+                syncedAt:
+                  format: date-time
+                  type: string
+                version:
+                  type: string
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}

clusters/cl01tl/manifests/traefik/CustomResourceDefinition-managedsubscriptions.hub.traefik.io.yaml

@@ -141,6 +141,7 @@ spec:
                   description: |-
                     Applications references the Applications that will gain access to the specified APIs.
                     Multiple ManagedSubscriptions can select the same AppID.
+
                     Deprecated: Use ManagedApplications instead.
                   items:
                     description: ApplicationReference references an Application.

clusters/cl01tl/manifests/traefik/CustomResourceDefinition-uplinks.hub.traefik.io.yaml

@@ -0,0 +1,199 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: uplinks.hub.traefik.io
+spec:
+  group: hub.traefik.io
+  names:
+    kind: Uplink
+    listKind: UplinkList
+    plural: uplinks
+    singular: uplink
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: |-
+            Uplink is an inter-cluster service advertisement: a child cluster declares an Uplink to advertise
+            to a parent cluster that it can handle a particular workload.
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: UplinkSpec describes the Uplink.
+              properties:
+                entryPoints:
+                  description: EntryPoints references uplinkEntryPoints. When omitted, uses default uplinkEntrypoints.
+                  items:
+                    type: string
+                  type: array
+                exposeName:
+                  description: |-
+                    ExposeName is the name of the service to expose.
+                    By default it uses <namespace>-<name>.
+                  type: string
+                healthCheck:
+                  description: HealthCheck configures the active health check on the parent cluster for this uplink's load balancer.
+                  properties:
+                    followRedirects:
+                      description: |-
+                        FollowRedirects defines whether redirects should be followed during the health check calls.
+                        Default: true
+                      type: boolean
+                    headers:
+                      additionalProperties:
+                        type: string
+                      description: Headers defines custom headers to be sent to the health check endpoint.
+                      type: object
+                    hostname:
+                      description: Hostname defines the value of hostname in the Host header of the health check request.
+                      type: string
+                    interval:
+                      anyOf:
+                        - type: integer
+                        - type: string
+                      description: |-
+                        Interval defines the frequency of the health check calls for healthy targets.
+                        Default: 30s
+                      x-kubernetes-int-or-string: true
+                    method:
+                      description: Method defines the healthcheck method.
+                      type: string
+                    mode:
+                      description: |-
+                        Mode defines the health check mode.
+                        If defined to grpc, will use the gRPC health check protocol to probe the server.
+                        Default: http
+                      type: string
+                    path:
+                      description: Path defines the server URL path for the health check endpoint.
+                      type: string
+                    port:
+                      description: Port defines the server URL port for the health check endpoint.
+                      type: integer
+                    scheme:
+                      description: Scheme replaces the server URL scheme for the health check endpoint.
+                      type: string
+                    status:
+                      description: Status defines the expected HTTP status code of the response to the health check request.
+                      type: integer
+                    timeout:
+                      anyOf:
+                        - type: integer
+                        - type: string
+                      description: |-
+                        Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
+                        Default: 5s
+                      x-kubernetes-int-or-string: true
+                    unhealthyInterval:
+                      anyOf:
+                        - type: integer
+                        - type: string
+                      description: |-
+                        UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.
+                        When UnhealthyInterval is not defined, it defaults to the Interval value.
+                        Default: 30s
+                      x-kubernetes-int-or-string: true
+                  type: object
+                passiveHealthCheck:
+                  description: PassiveHealthCheck configures the passive health check on the parent cluster for this uplink's load balancer.
+                  properties:
+                    failureWindow:
+                      anyOf:
+                        - type: integer
+                        - type: string
+                      description: FailureWindow defines the time window during which the failed attempts must occur for the server to be marked as unhealthy. It also defines for how long the server will be considered unhealthy.
+                      x-kubernetes-int-or-string: true
+                    maxFailedAttempts:
+                      description: MaxFailedAttempts is the number of consecutive failed attempts allowed within the failure window before marking the server as unhealthy.
+                      type: integer
+                  type: object
+                weight:
+                  description: Weight for WRR on the parent.
+                  type: integer
+                  x-kubernetes-validations:
+                    - message: must be a positive number
+                      rule: self >= 0
+              type: object
+            status:
+              description: The current status of this Uplink.
+              properties:
+                conditions:
+                  items:
+                    description: Condition contains details for one aspect of the current state of this API Resource.
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          lastTransitionTime is the last time the condition transitioned from one status to another.
+                          This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                        format: date-time
+                        type: string
+                      message:
+                        description: |-
+                          message is a human readable message indicating details about the transition.
+                          This may be an empty string.
+                        maxLength: 32768
+                        type: string
+                      observedGeneration:
+                        description: |-
+                          observedGeneration represents the .metadata.generation that the condition was set based upon.
+                          For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                          with respect to the current state of the instance.
+                        format: int64
+                        minimum: 0
+                        type: integer
+                      reason:
+                        description: |-
+                          reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                          Producers of specific condition types may define expected values and meanings for this field,
+                          and whether the values are considered a guaranteed API.
+                          The value should be a CamelCase string.
+                          This field may not be empty.
+                        maxLength: 1024
+                        minLength: 1
+                        pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                        type: string
+                      status:
+                        description: status of the condition, one of True, False, Unknown.
+                        enum:
+                          - "True"
+                          - "False"
+                          - Unknown
+                        type: string
+                      type:
+                        description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        maxLength: 316
+                        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                        type: string
+                    required:
+                      - lastTransitionTime
+                      - message
+                      - reason
+                      - status
+                      - type
+                    type: object
+                  type: array
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}

clusters/cl01tl/manifests/traefik/DaemonSet-traefik.yaml

@@ -6,7 +6,7 @@ metadata:
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-traefik
-    helm.sh/chart: traefik-39.0.9
+    helm.sh/chart: traefik-40.0.0
     app.kubernetes.io/managed-by: Helm
   annotations:
 spec:
@@ -27,7 +27,7 @@ spec:
         app.kubernetes.io/instance: traefik-traefik
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: traefik
-        helm.sh/chart: traefik-39.0.9
+        helm.sh/chart: traefik-40.0.0
     spec:
       automountServiceAccountToken: true
       containers:

clusters/cl01tl/manifests/traefik/Gateway-traefik-gateway.yaml

@@ -6,7 +6,7 @@ metadata:
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-traefik
-    helm.sh/chart: traefik-39.0.9
+    helm.sh/chart: traefik-40.0.0
     app.kubernetes.io/managed-by: Helm
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-issuer

clusters/cl01tl/manifests/traefik/GatewayClass-traefik.yaml

@@ -5,7 +5,7 @@ metadata:
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-traefik
-    helm.sh/chart: traefik-39.0.9
+    helm.sh/chart: traefik-40.0.0
     app.kubernetes.io/managed-by: Helm
 spec:
   controllerName: traefik.io/gateway-controller

clusters/cl01tl/manifests/traefik/IngressRoute-traefik-dashboard.yaml

@@ -6,7 +6,7 @@ metadata:
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-traefik
-    helm.sh/chart: traefik-39.0.9
+    helm.sh/chart: traefik-40.0.0
     app.kubernetes.io/managed-by: Helm
 spec:
   entryPoints:

clusters/cl01tl/manifests/traefik/PrometheusRule-traefik.yaml

@@ -6,7 +6,7 @@ metadata:
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-traefik
-    helm.sh/chart: traefik-39.0.9
+    helm.sh/chart: traefik-40.0.0
     app.kubernetes.io/managed-by: Helm
 spec:
   groups:

clusters/cl01tl/manifests/traefik/Service-traefik-metrics.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-traefik
     app.kubernetes.io/component: metrics
-    helm.sh/chart: traefik-39.0.9
+    helm.sh/chart: traefik-40.0.0
     app.kubernetes.io/managed-by: Helm
   annotations:
 spec:

clusters/cl01tl/manifests/traefik/Service-traefik.yaml

@@ -6,7 +6,7 @@ metadata:
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-traefik
-    helm.sh/chart: traefik-39.0.9
+    helm.sh/chart: traefik-40.0.0
     app.kubernetes.io/managed-by: Helm
   annotations:
 spec:
@@ -14,8 +14,6 @@ spec:
   selector:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-traefik
-  externalIPs:
-    - 10.232.1.21
   ports:
     - port: 22
       name: ssh

clusters/cl01tl/manifests/traefik/ServiceAccount-traefik.yaml

@@ -6,7 +6,7 @@ metadata:
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-traefik
-    helm.sh/chart: traefik-39.0.9
+    helm.sh/chart: traefik-40.0.0
     app.kubernetes.io/managed-by: Helm
   annotations:
 automountServiceAccountToken: false

clusters/cl01tl/manifests/traefik/ServiceMonitor-traefik.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-traefik
     app.kubernetes.io/component: metrics
-    helm.sh/chart: traefik-39.0.9
+    helm.sh/chart: traefik-40.0.0
     app.kubernetes.io/managed-by: Helm
 spec:
   jobLabel: traefik