chore: Update manifests after change

clusters/cl01tl/manifests/tdarr/Deployment-tdarr-server.yaml

@@ -29,6 +29,9 @@ spec:
       enableServiceLinks: false
       serviceAccountName: default
       automountServiceAccountToken: true
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
       hostIPC: false
       hostNetwork: false
       hostPID: false
@@ -36,7 +39,7 @@ spec:
       containers:
         - env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
             - name: PUID
               value: "1001"
             - name: PGID
@@ -57,13 +60,12 @@ spec:
               value: "8266"
             - name: webUIPort
               value: "8265"
-          image: ghcr.io/haveagitgat/tdarr:2.67.01
+          image: ghcr.io/haveagitgat/tdarr:2.67.01@sha256:dc23becc667f77d2489b1042bd3af87fdd2fd85c2802e126928ef2ced9a8f560
-          imagePullPolicy: IfNotPresent
           name: main
           resources:
             requests:
-              cpu: 200m
+              cpu: 500m
-              memory: 1Gi
+              memory: 2Gi
           volumeMounts:
             - mountPath: /app/configs
               name: config

clusters/cl01tl/manifests/tdarr/Deployment-tdarr-tdarr-exporter.yaml

@@ -31,7 +31,7 @@ spec:
       containers:
         - name: tdarr-exporter
           securityContext: {}
-          image: "docker.io/homeylab/tdarr-exporter:1.4.3"
+          image: "docker.io/homeylab/tdarr-exporter:1.4.3@sha256:88254cb505bfff20e86e04fa23a71789a411e7939e3bcbccbd5ef397ff91d052"
           imagePullPolicy: IfNotPresent
           ports:
             - name: metrics
@@ -77,5 +77,5 @@ spec:
             timeoutSeconds: 2
           resources:
             requests:
-              cpu: 10m
+              cpu: 1m
-              memory: 256Mi
+              memory: 10Mi

clusters/cl01tl/manifests/tdarr/HTTPRoute-tdarr.yaml

@@ -23,7 +23,7 @@ spec:
           name: tdarr-web
           namespace: tdarr
           port: 8265
-          weight: 100
+          weight: 1
       matches:
         - path:
             type: PathPrefix

clusters/cl01tl/manifests/tdarr/PersistentVolumeClaim-tdarr-config.yaml

@@ -7,8 +7,6 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: tdarr
     helm.sh/chart: tdarr-4.6.2
-  annotations:
-    helm.sh/resource-policy: keep
   namespace: tdarr
 spec:
   accessModes:

clusters/cl01tl/manifests/tdarr/PersistentVolumeClaim-tdarr-server.yaml

@@ -7,8 +7,6 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: tdarr
     helm.sh/chart: tdarr-4.6.2
-  annotations:
-    helm.sh/resource-policy: keep
   namespace: tdarr
 spec:
   accessModes:

clusters/cl01tl/manifests/tdarr/StatefulSet-tdarr-node.yaml

@@ -50,7 +50,7 @@ spec:
       containers:
         - env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
             - name: PUID
               value: "1001"
             - name: PGID
@@ -69,8 +69,7 @@ spec:
               value: tdarr-api
             - name: serverPort
               value: "8266"
-          image: ghcr.io/haveagitgat/tdarr_node:2.67.01
+          image: ghcr.io/haveagitgat/tdarr_node:2.67.01@sha256:048ae8ed4de8e9f0de51ad739b2105bee3e4d1a8575120df468cec5f6ef2b1da
-          imagePullPolicy: IfNotPresent
           name: main
           resources:
             limits:
@@ -78,7 +77,7 @@ spec:
             requests:
               cpu: 10m
               gpu.intel.com/i915: 1
-              memory: 512Mi
+              memory: 100Mi
           volumeMounts:
             - mountPath: /mnt/store
               name: media

clusters/cl01tl/manifests/traefik/DaemonSet-traefik.yaml

@@ -17,7 +17,7 @@ spec:
   updateStrategy:
     type: RollingUpdate
     rollingUpdate:
-      maxUnavailable: 0
+      maxUnavailable: 1
       maxSurge: 1
   minReadySeconds: 0
   template:
@@ -32,6 +32,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - args:
+            - --global.checkNewVersion=false
             - --entryPoints.metrics.address=:9100/tcp
             - --entryPoints.ssh.address=:22/tcp
             - --entryPoints.traefik.address=:8080/tcp
@@ -78,7 +79,7 @@ spec:
                   fieldPath: metadata.namespace
             - name: USER
               value: traefik
-          image: docker.io/traefik:v3.6.12
+          image: docker.io/traefik:v3.6.12@sha256:171c9c3565b29f6c133f1c1b43c5d4e5853415198e9e1078c001f8702ff66aec
           imagePullPolicy: IfNotPresent
           lifecycle: null
           livenessProbe:
@@ -118,7 +119,10 @@ spec:
             periodSeconds: 10
             successThreshold: 1
             timeoutSeconds: 2
-          resources: null
+          resources:
+            requests:
+              cpu: 10m
+              memory: 100Mi
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:

clusters/cl01tl/manifests/traefik/PodDisruptionBudget-traefik.yaml

@@ -0,0 +1,16 @@
+apiVersion: policy/v1beta1
+kind: PodDisruptionBudget
+metadata:
+  name: traefik
+  namespace: traefik
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/instance: traefik-traefik
+    helm.sh/chart: traefik-39.0.7
+    app.kubernetes.io/managed-by: Helm
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: traefik
+      app.kubernetes.io/instance: traefik-traefik
+  minAvailable: 1

clusters/cl01tl/manifests/traefik/PrometheusRule-traefik.yaml

@@ -0,0 +1,23 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: traefik
+  namespace: traefik
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/instance: traefik-traefik
+    helm.sh/chart: traefik-39.0.7
+    app.kubernetes.io/managed-by: Helm
+spec:
+  groups:
+    - name: traefik
+      rules:
+        - alert: TraefikDown
+          annotations:
+            description: '{{ $labels.pod }} on {{ $labels.nodename }} is down'
+            summary: Traefik Down
+          expr: up{job="traefik"} == 0
+          for: 5m
+          labels:
+            context: traefik
+            severity: warning

clusters/cl01tl/manifests/tubearchivist/Deployment-tubearchivist.yaml

@@ -29,13 +29,15 @@ spec:
       enableServiceLinks: false
       serviceAccountName: default
       automountServiceAccountToken: true
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
       hostIPC: false
       hostNetwork: false
       hostPID: false
       dnsPolicy: ClusterFirst
       containers:
-        - image: brainicism/bgutil-ytdlp-pot-provider:1.3.1
+        - image: brainicism/bgutil-ytdlp-pot-provider:1.3.1@sha256:1aaa43a0ca72dfca6a6d2129a0fb4a23465c25adb1b043f8aff829a20825646b
-          imagePullPolicy: IfNotPresent
           name: bgutil
         - env:
             - name: VPN_SERVICE_PROVIDER
@@ -68,7 +70,6 @@ spec:
             - name: SHADOWSOCKS
               value: "off"
           image: ghcr.io/qdm12/gluetun:v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab
-          imagePullPolicy: IfNotPresent
           lifecycle:
             postStart:
               exec:
@@ -91,9 +92,7 @@ spec:
             limits:
               devic.es/tun: "1"
             requests:
-              cpu: 10m
               devic.es/tun: "1"
-              memory: 128Mi
           securityContext:
             capabilities:
               add:
@@ -122,8 +121,7 @@ spec:
           envFrom:
             - secretRef:
                 name: tubearchivist-config-secret
-          image: bbilly1/tubearchivist:v0.5.10
+          image: bbilly1/tubearchivist:v0.5.10@sha256:dfe723cf008520e1758ecc3e59e6ea8761dd10d5bb099cd87289e80f5bd66567
-          imagePullPolicy: IfNotPresent
           name: main
           resources:
             requests:

clusters/cl01tl/manifests/tubearchivist/ExternalSecret-tubearchivist-config-secret.yaml

@@ -14,15 +14,9 @@ spec:
   data:
     - secretKey: ELASTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/tubearchivist/env
-        metadataPolicy: None
         property: ELASTIC_PASSWORD
     - secretKey: TA_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/tubearchivist/env
-        metadataPolicy: None
         property: TA_PASSWORD

clusters/cl01tl/manifests/tubearchivist/ExternalSecret-tubearchivist-elasticsearch-secret.yaml

@@ -14,22 +14,13 @@ spec:
   data:
     - secretKey: username
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/tubearchivist/elasticsearch
-        metadataPolicy: None
         property: username
     - secretKey: password
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/tubearchivist/elasticsearch
-        metadataPolicy: None
         property: password
     - secretKey: roles
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/tubearchivist/elasticsearch
-        metadataPolicy: None
         property: roles

clusters/cl01tl/manifests/tubearchivist/ExternalSecret-tubearchivist-wireguard-conf.yaml

@@ -14,29 +14,17 @@ spec:
   data:
     - secretKey: private-key
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /airvpn/conf/cl01tl
-        metadataPolicy: None
         property: private-key
     - secretKey: preshared-key
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /airvpn/conf/cl01tl
-        metadataPolicy: None
         property: preshared-key
     - secretKey: addresses
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /airvpn/conf/cl01tl
-        metadataPolicy: None
         property: addresses
     - secretKey: input-ports
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /airvpn/conf/cl01tl
-        metadataPolicy: None
         property: input-ports

clusters/cl01tl/manifests/tubearchivist/HTTPRoute-tubearchivist.yaml

@@ -23,7 +23,7 @@ spec:
           name: tubearchivist
           namespace: tubearchivist
           port: 80
-          weight: 100
+          weight: 1
       matches:
         - path:
             type: PathPrefix

clusters/cl01tl/manifests/tubearchivist/PersistentVolumeClaim-tubearchivist.yaml

@@ -7,8 +7,6 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: tubearchivist
     helm.sh/chart: tubearchivist-4.6.2
-  annotations:
-    helm.sh/resource-policy: keep
   namespace: tubearchivist
 spec:
   accessModes:

clusters/cl01tl/manifests/tubearchivist/StatefulSet-tubearchivist-valkey.yaml

@@ -94,8 +94,8 @@ spec:
               command: ["sh", "-c", "valkey-cli ping"]
           resources:
             requests:
-              cpu: 100m
+              cpu: 10m
-              memory: 1Gi
+              memory: 20Mi
           volumeMounts:
             - name: valkey-data
               mountPath: /data
@@ -117,8 +117,8 @@ spec:
               port: metrics
           resources:
             requests:
-              cpu: 10m
+              cpu: 1m
-              memory: 64M
+              memory: 10M
           env:
             - name: REDIS_ALIAS
               value: tubearchivist-valkey