chore: Update manifests after change

2026-03-27 02:03:22 +00:00
parent dfbc8d486a
commit d64fbfafde
21 changed files with 42 additions and 87 deletions
--- a/clusters/cl01tl/manifests/foldergram/Deployment-foldergram.yaml
+++ b/clusters/cl01tl/manifests/foldergram/Deployment-foldergram.yaml
@@ -29,6 +29,9 @@ spec:
      enableServiceLinks: false
      serviceAccountName: default
      automountServiceAccountToken: true
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
      hostIPC: false
      hostNetwork: false
      hostPID: false
--- a/clusters/cl01tl/manifests/gatus/Deployment-gatus.yaml
+++ b/clusters/cl01tl/manifests/gatus/Deployment-gatus.yaml
@@ -13,13 +13,13 @@ metadata:
    reloader.stakater.com/auto: "true"
 spec:
  replicas: 1
-  revisionHistoryLimit: 10
+  revisionHistoryLimit: 3
  selector:
    matchLabels:
      app.kubernetes.io/name: gatus
      app.kubernetes.io/instance: gatus
  strategy:
-    type: Recreate
+    type: RollingUpdate
  template:
    metadata:
      labels:
@@ -39,7 +39,7 @@ spec:
            runAsGroup: 65534
            runAsNonRoot: true
            runAsUser: 65534
-          image: "ghcr.io/twin/gatus:v5.35.0"
+          image: "ghcr.io/twin/gatus:v5.35.0@sha256:21609f31be8c4e680ce3004b24276305666239c99aff58391503f3fb6142f39d"
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
@@ -100,7 +100,7 @@ spec:
          resources:
            requests:
              cpu: 10m
-              memory: 128Mi
+              memory: 20Mi
          volumeMounts:
            - name: gatus-config
              mountPath: /config
--- a/clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-config-secret.yaml
+++ b/clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-config-secret.yaml
@@ -14,8 +14,5 @@ spec:
  data:
    - secretKey: NTFY_TOKEN
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /ntfy/user/cl01tl
-        metadataPolicy: None
        property: token
--- a/clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-oidc-secret.yaml
+++ b/clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-oidc-secret.yaml
@@ -14,15 +14,9 @@ spec:
  data:
    - secretKey: OIDC_CLIENT_ID
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /authentik/oidc/gatus
-        metadataPolicy: None
        property: client
    - secretKey: OIDC_CLIENT_SECRET
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /authentik/oidc/gatus
-        metadataPolicy: None
        property: secret
--- a/clusters/cl01tl/manifests/gitea/Cluster-gitea-postgresql-18-cluster.yaml
+++ b/clusters/cl01tl/manifests/gitea/Cluster-gitea-postgresql-18-cluster.yaml
@@ -26,8 +26,8 @@ spec:
    limits:
      hugepages-2Mi: 256Mi
    requests:
-      cpu: 200m
-      memory: 1Gi
+      cpu: 100m
+      memory: 100Mi
  affinity:
    enablePodAntiAffinity: true
    topologyKey: kubernetes.io/hostname
--- a/clusters/cl01tl/manifests/gitea/Deployment-gitea.yaml
+++ b/clusters/cl01tl/manifests/gitea/Deployment-gitea.yaml
@@ -9,15 +9,15 @@ metadata:
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.25.5"
-    version: "1.25.5"
+    app.kubernetes.io/version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
+    version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
    app.kubernetes.io/managed-by: Helm
 spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
-      maxUnavailable: 0
+      maxUnavailable: 1
      maxSurge: 100%
  selector:
    matchLabels:
@@ -26,22 +26,22 @@ spec:
  template:
    metadata:
      annotations:
-        checksum/config: 878b6957d244540764fe2218a124d9617a7d00acd64d1837f28805cdc5881739
+        checksum/config: b9d1223f0868e9701a10c61b13b4494578cbfe76301131a71a7196eebd8ec872
        checksum/oauth_0: 03073bf48e66f48f622bd02092a5f93bfd06dbcb5fd833aded3b0d40980be93d
      labels:
        helm.sh/chart: gitea-12.5.0
        app: gitea
        app.kubernetes.io/name: gitea
        app.kubernetes.io/instance: gitea
-        app.kubernetes.io/version: "1.25.5"
-        version: "1.25.5"
+        app.kubernetes.io/version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
+        version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
        app.kubernetes.io/managed-by: Helm
    spec:
      securityContext:
        fsGroup: 1000
      initContainers:
        - name: init-directories
-          image: "registry.hub.docker.com/gitea/gitea:1.25.5-rootless"
+          image: "registry.hub.docker.com/gitea/gitea:1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472-rootless"
          imagePullPolicy: IfNotPresent
          command:
            - "/usr/sbinx/init_directory_structure.sh"
@@ -71,7 +71,7 @@ spec:
              cpu: 100m
              memory: 128Mi
        - name: init-app-ini
-          image: "registry.hub.docker.com/gitea/gitea:1.25.5-rootless"
+          image: "registry.hub.docker.com/gitea/gitea:1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472-rootless"
          imagePullPolicy: IfNotPresent
          command:
            - "/usr/sbinx/config_environment.sh"
@@ -132,7 +132,7 @@ spec:
              cpu: 100m
              memory: 128Mi
        - name: configure-gitea
-          image: "registry.hub.docker.com/gitea/gitea:1.25.5-rootless"
+          image: "registry.hub.docker.com/gitea/gitea:1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472-rootless"
          command:
            - "/usr/sbinx/configure_gitea.sh"
          imagePullPolicy: IfNotPresent
@@ -183,7 +183,7 @@ spec:
      terminationGracePeriodSeconds: 60
      containers:
        - name: gitea
-          image: "registry.hub.docker.com/gitea/gitea:1.25.5-rootless"
+          image: "registry.hub.docker.com/gitea/gitea:1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472-rootless"
          imagePullPolicy: IfNotPresent
          env:
            - name: SSH_LISTEN_PORT
@@ -225,7 +225,10 @@ spec:
            tcpSocket:
              port: http
            timeoutSeconds: 1
-          resources: {}
+          resources:
+            requests:
+              cpu: 1000m
+              memory: 600Mi
          securityContext: {}
          volumeMounts:
            - name: temp
--- a/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-admin-secret.yaml
+++ b/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-admin-secret.yaml
@@ -14,15 +14,9 @@ spec:
  data:
    - secretKey: username
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/gitea/auth/admin
-        metadataPolicy: None
        property: username
    - secretKey: password
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/gitea/auth/admin
-        metadataPolicy: None
        property: password
--- a/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-meilisearch-master-key-secret.yaml
+++ b/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-meilisearch-master-key-secret.yaml
@@ -20,8 +20,5 @@ spec:
  data:
    - secretKey: MEILI_MASTER_KEY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/gitea/meilisearch
-        metadataPolicy: None
        property: MEILI_MASTER_KEY
--- a/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-oidc-secret.yaml
+++ b/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-oidc-secret.yaml
@@ -14,15 +14,9 @@ spec:
  data:
    - secretKey: secret
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /authentik/oidc/gitea
-        metadataPolicy: None
        property: secret
    - secretKey: key
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /authentik/oidc/gitea
-        metadataPolicy: None
        property: client
--- a/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-renovate-secret.yaml
+++ b/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-renovate-secret.yaml
@@ -14,36 +14,21 @@ spec:
  data:
    - secretKey: RENOVATE_ENDPOINT
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/gitea/renovate
-        metadataPolicy: None
        property: RENOVATE_ENDPOINT
    - secretKey: RENOVATE_GIT_AUTHOR
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/gitea/renovate
-        metadataPolicy: None
        property: RENOVATE_GIT_AUTHOR
    - secretKey: RENOVATE_TOKEN
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/gitea/renovate
-        metadataPolicy: None
        property: RENOVATE_TOKEN
    - secretKey: RENOVATE_GIT_PRIVATE_KEY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/gitea/renovate
-        metadataPolicy: None
        property: id_rsa
    - secretKey: RENOVATE_GITHUB_COM_TOKEN
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /github/gitea-cl01tl
-        metadataPolicy: None
        property: token
--- a/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-renovate-ssh-secret.yaml
+++ b/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-renovate-ssh-secret.yaml
@@ -14,22 +14,13 @@ spec:
  data:
    - secretKey: config
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/gitea/renovate
-        metadataPolicy: None
        property: ssh_config
    - secretKey: id_rsa
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/gitea/renovate
-        metadataPolicy: None
        property: id_rsa
    - secretKey: id_rsa.pub
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/gitea/renovate
-        metadataPolicy: None
        property: id_rsa.pub
--- a/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-runner-secret.yaml
+++ b/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-runner-secret.yaml
@@ -14,8 +14,5 @@ spec:
  data:
    - secretKey: token
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/gitea/runner
-        metadataPolicy: None
        property: token
--- a/clusters/cl01tl/manifests/gitea/Pod-gitea-test-connection.yaml
+++ b/clusters/cl01tl/manifests/gitea/Pod-gitea-test-connection.yaml
@@ -8,8 +8,8 @@ metadata:
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.25.5"
-    version: "1.25.5"
+    app.kubernetes.io/version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
+    version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
    app.kubernetes.io/managed-by: Helm
  annotations:
    "helm.sh/hook": test-success
--- a/clusters/cl01tl/manifests/gitea/Secret-gitea-init.yaml
+++ b/clusters/cl01tl/manifests/gitea/Secret-gitea-init.yaml
@@ -8,8 +8,8 @@ metadata:
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.25.5"
-    version: "1.25.5"
+    app.kubernetes.io/version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
+    version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
    app.kubernetes.io/managed-by: Helm
 type: Opaque
 stringData:
--- a/clusters/cl01tl/manifests/gitea/Secret-gitea-inline-config.yaml
+++ b/clusters/cl01tl/manifests/gitea/Secret-gitea-inline-config.yaml
@@ -8,8 +8,8 @@ metadata:
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.25.5"
-    version: "1.25.5"
+    app.kubernetes.io/version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
+    version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
    app.kubernetes.io/managed-by: Helm
 type: Opaque
 stringData:
--- a/clusters/cl01tl/manifests/gitea/Secret-gitea.yaml
+++ b/clusters/cl01tl/manifests/gitea/Secret-gitea.yaml
@@ -8,8 +8,8 @@ metadata:
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.25.5"
-    version: "1.25.5"
+    app.kubernetes.io/version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
+    version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
    app.kubernetes.io/managed-by: Helm
 type: Opaque
 stringData:
--- a/clusters/cl01tl/manifests/gitea/Service-gitea-http.yaml
+++ b/clusters/cl01tl/manifests/gitea/Service-gitea-http.yaml
@@ -8,8 +8,8 @@ metadata:
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.25.5"
-    version: "1.25.5"
+    app.kubernetes.io/version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
+    version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
    app.kubernetes.io/managed-by: Helm
  annotations: {}
 spec:
--- a/clusters/cl01tl/manifests/gitea/Service-gitea-ssh.yaml
+++ b/clusters/cl01tl/manifests/gitea/Service-gitea-ssh.yaml
@@ -8,8 +8,8 @@ metadata:
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.25.5"
-    version: "1.25.5"
+    app.kubernetes.io/version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
+    version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
    app.kubernetes.io/managed-by: Helm
  annotations: {}
 spec:
--- a/clusters/cl01tl/manifests/gitea/StatefulSet-gitea-gitea-actions-act-runner.yaml
+++ b/clusters/cl01tl/manifests/gitea/StatefulSet-gitea-gitea-actions-act-runner.yaml
@@ -34,7 +34,7 @@ spec:
      securityContext: {}
      initContainers:
        - name: init-gitea
-          image: "busybox:1.37.0"
+          image: "registry.hub.docker.com/busybox:1.37.0@sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e"
          command:
            - sh
            - -c
@@ -46,7 +46,7 @@ spec:
              done
              echo "Gitea has been reached!"
        - name: dind
-          image: "docker:28.3.3-dind"
+          image: "registry.hub.docker.com/docker:29.3.1-dind@sha256:4d90f1f6c400315c2dba96d3ec93c01e64198395cbba04f79d12adce4f737029"
          imagePullPolicy: IfNotPresent
          restartPolicy: Always
          securityContext:
@@ -69,7 +69,7 @@ spec:
              name: docker-socket
      containers:
        - name: act-runner
-          image: "gitea/act_runner:0.2.13"
+          image: "registry.hub.docker.com/gitea/act_runner:0.3.1@sha256:c2a169c5e99864c25e32527cef3d82203225e09558773022bf3dc164a2e6d762"
          imagePullPolicy: IfNotPresent
          workingDir: /data
          env:
@@ -107,4 +107,4 @@ spec:
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
-            storage: 5Gi
+            storage: 10Gi
--- a/clusters/cl01tl/manifests/gitea/StatefulSet-gitea-meilisearch.yaml
+++ b/clusters/cl01tl/manifests/gitea/StatefulSet-gitea-meilisearch.yaml
@@ -91,5 +91,5 @@ spec:
            timeoutSeconds: 10
          resources:
            requests:
-              cpu: 10m
-              memory: 128Mi
+              cpu: 1m
+              memory: 160Mi
--- a/clusters/cl01tl/manifests/gitea/StatefulSet-gitea-valkey.yaml
+++ b/clusters/cl01tl/manifests/gitea/StatefulSet-gitea-valkey.yaml
@@ -95,7 +95,7 @@ spec:
          resources:
            requests:
              cpu: 20m
-              memory: 256Mi
+              memory: 2Gi
          volumeMounts:
            - name: valkey-data
              mountPath: /data