Automated Manifest Update (#5173)

This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow.

### Details
- **Trigger**: `pull_request` by `@alexlebens`
- **Commit**: `c3e134f` (on `c3e134ffba591e2752db6fe0a1721ea0de524b87`)
- **Charts Updated**: `eraser,excalidraw,external-dns,external-secrets`

### Update Details (2026-03-27 00:30 UTC)
- **Trigger**: `pull_request` by `@alexlebens`
- **Commit**: `f09911d` (on `f09911d84f8bf423991c1d2d52318926b66eef76`)
- **Charts Updated**: `external-dns`

Reviewed-on: #5173
Co-authored-by: gitea-bot <gitea-bot@alexlebens.net>
Co-committed-by: gitea-bot <gitea-bot@alexlebens.net>

clusters/cl01tl/manifests/eraser/ConfigMap-eraser-manager-config.yaml

@@ -10,27 +10,27 @@ data:
       collector:
         enabled: true
         image:
-          tag: v1.4.1
+          repo: ghcr.io/eraser-dev/collector
+          tag: v1.4.1@sha256:827588ff826c3558bf2c50b1fc94f20122b054dfcf3480c3ffe6f0bae25c3dad
         limit: {}
         request:
-          cpu: 10m
+          cpu: 1m
-          memory: 128Mi
+          memory: 20Mi
       remover:
         image:
-          tag: v1.4.1
+          repo: ghcr.io/eraser-dev/remover
+          tag: v1.4.1@sha256:e57592157d717588f69c011cd0b6ab783a19a53b447a5350b27e7e66aae67525
         limit: {}
         request:
-          cpu: 10m
+          cpu: 1m
-          memory: 128Mi
+          memory: 20Mi
       scanner:
         config: ""
         enabled: false
         image:
           tag: v1.4.1
         limit: {}
-        request:
+        request: {}
-          cpu: 100m
-          memory: 128Mi
     health: {}
     kind: EraserConfig
     leaderElection: {}
@@ -49,9 +49,7 @@ data:
         type: exclude
       otlpEndpoint: ""
       priorityClassName: ""
-      profile:
+      profile: {}
-        enabled: false
-        port: 6060
       pullSecrets: []
       runtime:
         address: unix:///run/containerd/containerd.sock

clusters/cl01tl/manifests/eraser/Deployment-eraser-controller-manager.yaml

@@ -41,7 +41,7 @@ spec:
                   fieldPath: metadata.namespace
             - name: OTEL_SERVICE_NAME
               value: eraser-manager
-          image: 'ghcr.io/eraser-dev/eraser-manager:v1.4.1'
+          image: 'ghcr.io/eraser-dev/eraser-manager:v1.4.1@sha256:5f18fb7da4ccad93a8643ece496681f1489b0d7b0ce45e18a94774cf8b6a717d'
           imagePullPolicy: 'IfNotPresent'
           livenessProbe:
             httpGet:
@@ -57,11 +57,10 @@ spec:
             initialDelaySeconds: 5
             periodSeconds: 10
           resources:
-            limits:
+            limits: {}
-              memory: 30Mi
             requests:
-              cpu: 10m
+              cpu: 1m
-              memory: 30Mi
+              memory: 20Mi
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:

clusters/cl01tl/manifests/excalidraw/Deployment-excalidraw.yaml

@@ -40,9 +40,8 @@ spec:
             - name: TZ
               value: America/Chicago
           image: excalidraw/excalidraw:latest@sha256:3c2513e830bb6e195147c05b34ecf8393d0ba2b1cc86e93b407a5777d6135c6c
-          imagePullPolicy: IfNotPresent
           name: main
           resources:
             requests:
-              cpu: 10m
+              cpu: 1m
-              memory: 128Mi
+              memory: 10Mi

clusters/cl01tl/manifests/excalidraw/HTTPRoute-excalidraw.yaml

@@ -23,7 +23,7 @@ spec:
           name: excalidraw
           namespace: excalidraw
           port: 80
-          weight: 100
+          weight: 1
       matches:
         - path:
             type: PathPrefix

clusters/cl01tl/manifests/external-dns/ClusterRole-external-dns-unifi.yaml

@@ -9,9 +9,6 @@ metadata:
     app.kubernetes.io/version: "0.20.0"
     app.kubernetes.io/managed-by: Helm
 rules:
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "watch", "list"]
   - apiGroups: ["externaldns.k8s.io"]
     resources: ["dnsendpoints"]
     verbs: ["get", "watch", "list"]

clusters/cl01tl/manifests/external-dns/Deployment-external-dns-unifi.yaml

@@ -47,8 +47,7 @@ spec:
           args:
             - --log-level=info
             - --log-format=text
-            - --interval=1m
+            - --interval=360m
-            - --source=ingress
             - --source=crd
             - --source=gateway-httproute
             - --source=gateway-tlsroute
@@ -57,6 +56,7 @@ spec:
             - --txt-owner-id=default
             - --txt-prefix=k8s.
             - --domain-filter=alexlebens.net
+            - --exclude-domains=alexlebens.dev
             - --provider=webhook
             - --ignore-ingress-tls-spec
           ports:
@@ -81,8 +81,12 @@ spec:
             periodSeconds: 10
             successThreshold: 1
             timeoutSeconds: 5
+          resources:
+            requests:
+              cpu: 1m
+              memory: 80Mi
         - name: webhook
-          image: ghcr.io/kashalls/external-dns-unifi-webhook:v0.8.2
+          image: ghcr.io/kashalls/external-dns-unifi-webhook:v0.8.2@sha256:7f0ddbbc83a36a2a9d762e25eef9cafcb3adf0493068a27d72ae71087eafe6f0
           imagePullPolicy: IfNotPresent
           env:
             - name: UNIFI_HOST
@@ -93,7 +97,7 @@ spec:
                   key: api-key
                   name: external-dns-unifi-secret
             - name: LOG_LEVEL
-              value: debug
+              value: info
           ports:
             - name: http-webhook
               protocol: TCP
@@ -112,7 +116,7 @@ spec:
             httpGet:
               path: /readyz
               port: http-webhook
-            initialDelaySeconds: 10
+            initialDelaySeconds: 5
             periodSeconds: 10
             successThreshold: 1
             timeoutSeconds: 5

clusters/cl01tl/manifests/external-dns/ExternalSecret-external-dns-unifi-secret.yaml

@@ -14,8 +14,5 @@ spec:
   data:
     - secretKey: api-key
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /unifi/auth/cl01tl
-        metadataPolicy: None
         property: api-key

clusters/cl01tl/manifests/external-secrets/Deployment-external-secrets-cert-controller.yaml

@@ -40,7 +40,7 @@ spec:
             runAsUser: 1000
             seccompProfile:
               type: RuntimeDefault
-          image: ghcr.io/external-secrets/external-secrets:v2.2.0
+          image: ghcr.io/external-secrets/external-secrets:v2.2.0@sha256:876e627dbee5b0edd12da49b035469d12418cd6c3c4be5e383ae6a82e8bd4565
           imagePullPolicy: IfNotPresent
           args:
             - certcontroller
@@ -54,6 +54,7 @@ spec:
             - --loglevel=info
             - --zap-time-encoding=epoch
             - --enable-partial-cache=true
+            - --enable-leader-election=true
           ports:
             - containerPort: 8080
               protocol: TCP
@@ -67,3 +68,7 @@ spec:
               path: /readyz
             initialDelaySeconds: 20
             periodSeconds: 5
+          resources:
+            requests:
+              cpu: 1m
+              memory: 60Mi

clusters/cl01tl/manifests/external-secrets/Deployment-external-secrets-webhook.yaml

@@ -40,7 +40,7 @@ spec:
             runAsUser: 1000
             seccompProfile:
               type: RuntimeDefault
-          image: ghcr.io/external-secrets/external-secrets:v2.2.0
+          image: ghcr.io/external-secrets/external-secrets:v2.2.0@sha256:876e627dbee5b0edd12da49b035469d12418cd6c3c4be5e383ae6a82e8bd4565
           imagePullPolicy: IfNotPresent
           args:
             - webhook
@@ -68,6 +68,10 @@ spec:
               path: /readyz
             initialDelaySeconds: 20
             periodSeconds: 5
+          resources:
+            requests:
+              cpu: 1m
+              memory: 30Mi
           volumeMounts:
             - name: certs
               mountPath: /tmp/certs

clusters/cl01tl/manifests/external-secrets/Deployment-external-secrets.yaml

@@ -40,15 +40,43 @@ spec:
             runAsUser: 1000
             seccompProfile:
               type: RuntimeDefault
-          image: ghcr.io/external-secrets/external-secrets:v2.2.0
+          image: ghcr.io/external-secrets/external-secrets:v2.2.0@sha256:876e627dbee5b0edd12da49b035469d12418cd6c3c4be5e383ae6a82e8bd4565
           imagePullPolicy: IfNotPresent
           args:
+            - --enable-leader-election=true
+            - --enable-extended-metric-labels=true
             - --concurrent=1
             - --metrics-addr=:8080
             - --loglevel=info
             - --zap-time-encoding=epoch
+            - --live-addr=:8082
           ports:
             - containerPort: 8080
               protocol: TCP
               name: metrics
+            - name: live
+              protocol: TCP
+              containerPort: 8082
+          livenessProbe:
+            failureThreshold: 5
+            httpGet:
+              path: /healthz
+              port: live
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          readinessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /readyz
+              port: live
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          resources:
+            requests:
+              cpu: 5m
+              memory: 50Mi
       dnsPolicy: ClusterFirst

clusters/cl01tl/manifests/external-secrets/PodDisruptionBudget-external-secrets-pdb.yaml

@@ -0,0 +1,17 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: "external-secrets-pdb"
+  namespace: external-secrets
+  labels:
+    helm.sh/chart: external-secrets-2.2.0
+    app.kubernetes.io/name: external-secrets
+    app.kubernetes.io/instance: external-secrets
+    app.kubernetes.io/version: "v2.2.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: external-secrets
+      app.kubernetes.io/instance: external-secrets