Merge pull request 'Automated Manifest Update' (#5704) from auto/update-manifests into manifests

Reviewed-on: #5704

clusters/cl01tl/manifests/harbor/Cluster-harbor-postgresql-18-cluster.yaml

@@ -5,10 +5,10 @@ metadata:
   namespace: harbor
   labels:
     app.kubernetes.io/name: harbor-postgresql-18-cluster
-    helm.sh/chart: postgres-18-cluster-7.11.1
+    helm.sh/chart: postgres-18-cluster-7.11.2
     app.kubernetes.io/instance: harbor
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "7.11.1"
+    app.kubernetes.io/version: "7.11.2"
     app.kubernetes.io/managed-by: Helm
 spec:
   instances: 3

clusters/cl01tl/manifests/harbor/ExternalSecret-harbor-postgresql-18-backup-garage-local-secret.yaml

@@ -5,10 +5,10 @@ metadata:
   namespace: harbor
   labels:
     app.kubernetes.io/name: harbor-postgresql-18-backup-garage-local-secret
-    helm.sh/chart: postgres-18-cluster-7.11.1
+    helm.sh/chart: postgres-18-cluster-7.11.2
     app.kubernetes.io/instance: harbor
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "7.11.1"
+    app.kubernetes.io/version: "7.11.2"
     app.kubernetes.io/managed-by: Helm
 spec:
   secretStoreRef:

clusters/cl01tl/manifests/harbor/ExternalSecret-harbor-postgresql-18-recovery-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: harbor-postgresql-18-recovery-secret
   namespace: harbor
   labels:
-    helm.sh/chart: postgres-18-cluster-7.11.1
+    helm.sh/chart: postgres-18-cluster-7.11.2
     app.kubernetes.io/instance: harbor
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "7.11.1"
+    app.kubernetes.io/version: "7.11.2"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: harbor-postgresql-18-recovery-secret
 spec:

clusters/cl01tl/manifests/harbor/ObjectStore-harbor-postgresql-18-backup-garage-local.yaml

@@ -5,10 +5,10 @@ metadata:
   namespace: harbor
   labels:
     app.kubernetes.io/name: harbor-postgresql-18-backup-garage-local
-    helm.sh/chart: postgres-18-cluster-7.11.1
+    helm.sh/chart: postgres-18-cluster-7.11.2
     app.kubernetes.io/instance: harbor
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "7.11.1"
+    app.kubernetes.io/version: "7.11.2"
     app.kubernetes.io/managed-by: Helm
 spec:
   retentionPolicy: 7d

clusters/cl01tl/manifests/harbor/ObjectStore-harbor-postgresql-18-recovery.yaml

@@ -4,10 +4,10 @@ metadata:
   name: "harbor-postgresql-18-recovery"
   namespace: harbor
   labels:
-    helm.sh/chart: postgres-18-cluster-7.11.1
+    helm.sh/chart: postgres-18-cluster-7.11.2
     app.kubernetes.io/instance: harbor
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "7.11.1"
+    app.kubernetes.io/version: "7.11.2"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: "harbor-postgresql-18-recovery"
 spec:

clusters/cl01tl/manifests/harbor/PrometheusRule-harbor-postgresql-18-alert-rules.yaml

@@ -5,10 +5,10 @@ metadata:
   namespace: harbor
   labels:
     app.kubernetes.io/name: harbor-postgresql-18-alert-rules
-    helm.sh/chart: postgres-18-cluster-7.11.1
+    helm.sh/chart: postgres-18-cluster-7.11.2
     app.kubernetes.io/instance: harbor
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "7.11.1"
+    app.kubernetes.io/version: "7.11.2"
     app.kubernetes.io/managed-by: Helm
 spec:
   groups:

clusters/cl01tl/manifests/harbor/ScheduledBackup-harbor-postgresql-18-scheduled-backup-live-backup.yaml

@@ -5,10 +5,10 @@ metadata:
   namespace: harbor
   labels:
     app.kubernetes.io/name: "harbor-postgresql-18-scheduled-backup-live-backup"
-    helm.sh/chart: postgres-18-cluster-7.11.1
+    helm.sh/chart: postgres-18-cluster-7.11.2
     app.kubernetes.io/instance: harbor
     app.kubernetes.io/part-of: harbor
-    app.kubernetes.io/version: "7.11.1"
+    app.kubernetes.io/version: "7.11.2"
     app.kubernetes.io/managed-by: Helm
 spec:
   immediate: true

clusters/cl01tl/manifests/tdarr/Deployment-tdarr-server.yaml

@@ -60,7 +60,7 @@ spec:
               value: "8266"
             - name: webUIPort
               value: "8265"
-          image: ghcr.io/haveagitgat/tdarr:2.67.01@sha256:dc23becc667f77d2489b1042bd3af87fdd2fd85c2802e126928ef2ced9a8f560
+          image: ghcr.io/haveagitgat/tdarr:2.67.01@sha256:048ae8ed4de8e9f0de51ad739b2105bee3e4d1a8575120df468cec5f6ef2b1da
           name: main
           resources:
             requests:

clusters/cl01tl/manifests/tdarr/StatefulSet-tdarr-node.yaml

@@ -69,7 +69,7 @@ spec:
               value: tdarr-api
             - name: serverPort
               value: "8266"
-          image: ghcr.io/haveagitgat/tdarr_node:2.67.01@sha256:048ae8ed4de8e9f0de51ad739b2105bee3e4d1a8575120df468cec5f6ef2b1da
+          image: ghcr.io/haveagitgat/tdarr_node:2.67.01@sha256:dc23becc667f77d2489b1042bd3af87fdd2fd85c2802e126928ef2ced9a8f560
           name: main
           resources:
             limits:

clusters/cl01tl/manifests/unpackerr/Deployment-unpackerr.yaml

@@ -29,6 +29,9 @@ spec:
       enableServiceLinks: false
       serviceAccountName: default
       automountServiceAccountToken: true
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
       hostIPC: false
       hostNetwork: false
       hostPID: false
@@ -36,7 +39,7 @@ spec:
       containers:
         - env:
             - name: TZ
-              value: US/Central
+              value: America/Chicago
             - name: UN_WEBSERVER_METRICS
               value: "true"
             - name: UN_SONARR_0_URL
@@ -74,13 +77,12 @@ spec:
           envFrom:
             - secretRef:
                 name: unpackerr-key-secret
-          image: golift/unpackerr:0.15.2
+          image: golift/unpackerr:0.15.2@sha256:057e34740d26c34d81ec8e2faf8ec11f8dbfc77489b7a42826f52b37e5ee1b6c
-          imagePullPolicy: IfNotPresent
           name: main
           resources:
             requests:
               cpu: 10m
-              memory: 128Mi
+              memory: 10Mi
           volumeMounts:
             - mountPath: /mnt/store
               name: storage

clusters/cl01tl/manifests/unpackerr/ExternalSecret-unpackerr-key-secret.yaml

@@ -14,57 +14,33 @@ spec:
   data:
     - secretKey: UN_SONARR_0_API_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/sonarr4/key
-        metadataPolicy: None
         property: key
     - secretKey: UN_SONARR_1_API_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/sonarr4-4k/key
-        metadataPolicy: None
         property: key
     - secretKey: UN_SONARR_2_API_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/sonarr4-anime/key
-        metadataPolicy: None
         property: key
     - secretKey: UN_RADARR_0_API_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/radarr5/key
-        metadataPolicy: None
         property: key
     - secretKey: UN_RADARR_1_API_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/radarr5-4k/key
-        metadataPolicy: None
         property: key
     - secretKey: UN_RADARR_2_API_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/radarr5-anime/key
-        metadataPolicy: None
         property: key
     - secretKey: UN_RADARR_3_API_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/radarr5-standup/key
-        metadataPolicy: None
         property: key
     - secretKey: UN_LIDARR_0_API_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/lidarr2/key
-        metadataPolicy: None
         property: key

clusters/cl01tl/manifests/unpoller/Deployment-unpoller.yaml

@@ -36,7 +36,7 @@ spec:
       containers:
         - env:
             - name: UP_UNIFI_CONTROLLER_0_SAVE_ALARMS
-              value: "false"
+              value: "true"
             - name: UP_UNIFI_CONTROLLER_0_SAVE_ANOMALIES
               value: "false"
             - name: UP_UNIFI_CONTROLLER_0_SAVE_DPI
@@ -44,7 +44,7 @@ spec:
             - name: UP_UNIFI_CONTROLLER_0_SAVE_EVENTS
               value: "false"
             - name: UP_UNIFI_CONTROLLER_0_SAVE_IDS
-              value: "false"
+              value: "true"
             - name: UP_UNIFI_CONTROLLER_0_SAVE_SITES
               value: "true"
             - name: UP_UNIFI_CONTROLLER_0_URL
@@ -64,10 +64,9 @@ spec:
           envFrom:
             - secretRef:
                 name: unpoller-unifi-secret
-          image: ghcr.io/unpoller/unpoller:v2.39.0
+          image: ghcr.io/unpoller/unpoller:v2.39.0@sha256:1cf63ad43121acc6995da1bd636063de9023b4bfc16599a4297951a6fb6b7fd2
-          imagePullPolicy: IfNotPresent
           name: main
           resources:
             requests:
               cpu: 10m
-              memory: 64Mi
+              memory: 20Mi

clusters/cl01tl/manifests/unpoller/ExternalSecret-unpoller-unifi-secret.yaml

@@ -14,15 +14,9 @@ spec:
   data:
     - secretKey: UP_UNIFI_CONTROLLER_0_USER
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /unifi/auth/cl01tl
-        metadataPolicy: None
         property: user
     - secretKey: UP_UNIFI_CONTROLLER_0_PASS
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /unifi/auth/cl01tl
-        metadataPolicy: None
         property: password

clusters/cl01tl/manifests/vault/CronJob-vault-snapshot.yaml

@@ -12,11 +12,11 @@ metadata:
 spec:
   suspend: false
   concurrencyPolicy: Forbid
-  startingDeadlineSeconds: 90
+  startingDeadlineSeconds: 30
-  timeZone: US/Central
+  timeZone: America/Chicago
   schedule: "0 4 * * *"
   successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 1
   jobTemplate:
     spec:
       parallelism: 1
@@ -48,8 +48,7 @@ spec:
               envFrom:
                 - secretRef:
                     name: vault-snapshot-agent-token
-              image: hashicorp/vault:1.21.4
+              image: hashicorp/vault:1.21.4@sha256:4e33b126a59c0c333b76fb4e894722462659a6bec7c48c9ee8cea56fccfd2569
-              imagePullPolicy: IfNotPresent
               name: snapshot
               volumeMounts:
                 - mountPath: /opt/backup

clusters/cl01tl/manifests/vault/Deployment-vault-unseal-unseal-1.yaml

@@ -37,10 +37,9 @@ spec:
         - envFrom:
             - secretRef:
                 name: vault-unseal-config-1
-          image: ghcr.io/lrstanley/vault-unseal:0.7.2
+          image: ghcr.io/lrstanley/vault-unseal:0.7.2@sha256:b25d0c2f6a73d1b9a3907befa473f08fe9fac828d248d7e9702517c5b967733c
-          imagePullPolicy: IfNotPresent
           name: main
           resources:
             requests:
-              cpu: 10m
+              cpu: 1m
-              memory: 24Mi
+              memory: 10Mi

clusters/cl01tl/manifests/vault/Deployment-vault-unseal-unseal-2.yaml

@@ -37,10 +37,9 @@ spec:
         - envFrom:
             - secretRef:
                 name: vault-unseal-config-2
-          image: ghcr.io/lrstanley/vault-unseal:0.7.2
+          image: ghcr.io/lrstanley/vault-unseal:0.7.2@sha256:b25d0c2f6a73d1b9a3907befa473f08fe9fac828d248d7e9702517c5b967733c
-          imagePullPolicy: IfNotPresent
           name: main
           resources:
             requests:
-              cpu: 10m
+              cpu: 1m
-              memory: 24Mi
+              memory: 10Mi

clusters/cl01tl/manifests/vault/Deployment-vault-unseal-unseal-3.yaml

@@ -37,10 +37,9 @@ spec:
         - envFrom:
             - secretRef:
                 name: vault-unseal-config-3
-          image: ghcr.io/lrstanley/vault-unseal:0.7.2
+          image: ghcr.io/lrstanley/vault-unseal:0.7.2@sha256:b25d0c2f6a73d1b9a3907befa473f08fe9fac828d248d7e9702517c5b967733c
-          imagePullPolicy: IfNotPresent
           name: main
           resources:
             requests:
-              cpu: 10m
+              cpu: 1m
-              memory: 24Mi
+              memory: 10Mi

clusters/cl01tl/manifests/vault/ExternalSecret-vault-backup-ntfy-secret.yaml

@@ -14,22 +14,13 @@ spec:
   data:
     - secretKey: NTFY_TOKEN
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /ntfy/user/cl01tl
-        metadataPolicy: None
         property: token
     - secretKey: NTFY_ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /ntfy/user/cl01tl
-        metadataPolicy: None
         property: endpoint
     - secretKey: NTFY_TOPIC
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/snapshot
-        metadataPolicy: None
         property: NTFY_TOPIC

clusters/cl01tl/manifests/vault/ExternalSecret-vault-s3cmd-external-config.yaml

@@ -14,15 +14,9 @@ spec:
   data:
     - secretKey: .s3cfg
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/vault-backup
-        metadataPolicy: None
         property: s3cfg
     - secretKey: BUCKET
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/vault-backup
-        metadataPolicy: None
         property: BUCKET

clusters/cl01tl/manifests/vault/ExternalSecret-vault-s3cmd-local-config.yaml

@@ -14,15 +14,9 @@ spec:
   data:
     - secretKey: .s3cfg
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/vault-backups
-        metadataPolicy: None
         property: s3cfg-local
     - secretKey: BUCKET
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/vault-backups
-        metadataPolicy: None
         property: BUCKET

clusters/cl01tl/manifests/vault/ExternalSecret-vault-s3cmd-remote-config.yaml

@@ -14,15 +14,9 @@ spec:
   data:
     - secretKey: .s3cfg
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/vault-backups
-        metadataPolicy: None
         property: s3cfg-remote
     - secretKey: BUCKET
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/vault-backups
-        metadataPolicy: None
         property: BUCKET

clusters/cl01tl/manifests/vault/ExternalSecret-vault-snapshot-agent-token.yaml

@@ -14,15 +14,9 @@ spec:
   data:
     - secretKey: VAULT_APPROLE_ROLE_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/snapshot
-        metadataPolicy: None
         property: VAULT_APPROLE_ROLE_ID
     - secretKey: VAULT_APPROLE_SECRET_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/snapshot
-        metadataPolicy: None
         property: VAULT_APPROLE_SECRET_ID

clusters/cl01tl/manifests/vault/ExternalSecret-vault-token.yaml

@@ -14,43 +14,25 @@ spec:
   data:
     - secretKey: token
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/token
-        metadataPolicy: None
         property: token
     - secretKey: unseal_key_1
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/token
-        metadataPolicy: None
         property: unseal_key_1
     - secretKey: unseal_key_2
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/token
-        metadataPolicy: None
         property: unseal_key_2
     - secretKey: unseal_key_3
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/token
-        metadataPolicy: None
         property: unseal_key_3
     - secretKey: unseal_key_4
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/token
-        metadataPolicy: None
         property: unseal_key_4
     - secretKey: unseal_key_5
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/token
-        metadataPolicy: None
         property: unseal_key_5

clusters/cl01tl/manifests/vault/ExternalSecret-vault-unseal-config-1.yaml

@@ -14,64 +14,37 @@ spec:
   data:
     - secretKey: ENVIRONMENT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
         property: ENVIRONMENT
     - secretKey: CHECK_INTERVAL
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
         property: CHECK_INTERVAL
     - secretKey: MAX_CHECK_INTERVAL
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
         property: MAX_CHECK_INTERVAL
     - secretKey: NODES
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
         property: NODES
     - secretKey: TLS_SKIP_VERIFY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
         property: TLS_SKIP_VERIFY
     - secretKey: TOKENS
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
         property: TOKENS
     - secretKey: EMAIL_ENABLED
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
         property: EMAIL_ENABLED
     - secretKey: NOTIFY_MAX_ELAPSED
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
         property: NOTIFY_MAX_ELAPSED
     - secretKey: NOTIFY_QUEUE_DELAY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
         property: NOTIFY_QUEUE_DELAY

clusters/cl01tl/manifests/vault/ExternalSecret-vault-unseal-config-2.yaml

@@ -14,64 +14,37 @@ spec:
   data:
     - secretKey: ENVIRONMENT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
         property: ENVIRONMENT
     - secretKey: CHECK_INTERVAL
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
         property: CHECK_INTERVAL
     - secretKey: MAX_CHECK_INTERVAL
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
         property: MAX_CHECK_INTERVAL
     - secretKey: NODES
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
         property: NODES
     - secretKey: TLS_SKIP_VERIFY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
         property: TLS_SKIP_VERIFY
     - secretKey: TOKENS
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
         property: TOKENS
     - secretKey: EMAIL_ENABLED
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
         property: EMAIL_ENABLED
     - secretKey: NOTIFY_MAX_ELAPSED
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
         property: NOTIFY_MAX_ELAPSED
     - secretKey: NOTIFY_QUEUE_DELAY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
         property: NOTIFY_QUEUE_DELAY

clusters/cl01tl/manifests/vault/ExternalSecret-vault-unseal-config-3.yaml

@@ -14,64 +14,37 @@ spec:
   data:
     - secretKey: ENVIRONMENT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
         property: ENVIRONMENT
     - secretKey: CHECK_INTERVAL
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
         property: CHECK_INTERVAL
     - secretKey: MAX_CHECK_INTERVAL
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
         property: MAX_CHECK_INTERVAL
     - secretKey: NODES
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
         property: NODES
     - secretKey: TLS_SKIP_VERIFY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
         property: TLS_SKIP_VERIFY
     - secretKey: TOKENS
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
         property: TOKENS
     - secretKey: EMAIL_ENABLED
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
         property: EMAIL_ENABLED
     - secretKey: NOTIFY_MAX_ELAPSED
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
         property: NOTIFY_MAX_ELAPSED
     - secretKey: NOTIFY_QUEUE_DELAY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
         property: NOTIFY_QUEUE_DELAY

clusters/cl01tl/manifests/vault/HTTPRoute-vault.yaml

@@ -25,4 +25,3 @@ spec:
           kind: Service
           name: vault-active
           port: 8200
-          weight: 100

clusters/cl01tl/manifests/vault/Pod-vault-server-test.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   containers:
     - name: vault-server-test
-      image: hashicorp/vault:1.21.4
+      image: hashicorp/vault:1.21.4@sha256:4e33b126a59c0c333b76fb4e894722462659a6bec7c48c9ee8cea56fccfd2569
       imagePullPolicy: IfNotPresent
       env:
         - name: VAULT_ADDR

clusters/cl01tl/manifests/vault/Service-vault-active.yaml

@@ -11,7 +11,6 @@ metadata:
     vault-active: "true"
   annotations:
 spec:
-  type: ClusterIP
   publishNotReadyAddresses: true
   ports:
     - name: http

clusters/cl01tl/manifests/vault/Service-vault-standby.yaml

@@ -1,21 +1,25 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: vault-ui
+  name: vault-standby
   namespace: vault
   labels:
     helm.sh/chart: vault-0.32.0
-    app.kubernetes.io/name: vault-ui
-    app.kubernetes.io/instance: vault
-    app.kubernetes.io/managed-by: Helm
-spec:
-  selector:
     app.kubernetes.io/name: vault
     app.kubernetes.io/instance: vault
-    component: server
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+spec:
   publishNotReadyAddresses: true
   ports:
     - name: http
       port: 8200
       targetPort: 8200
-  type: ClusterIP
+    - name: https-internal
+      port: 8201
+      targetPort: 8201
+  selector:
+    app.kubernetes.io/name: vault
+    app.kubernetes.io/instance: vault
+    component: server
+    vault-active: "false"

clusters/cl01tl/manifests/vault/Service-vault.yaml

@@ -10,7 +10,6 @@ metadata:
     app.kubernetes.io/managed-by: Helm
   annotations:
 spec:
-  type: ClusterIP
   publishNotReadyAddresses: true
   ports:
     - name: http

clusters/cl01tl/manifests/vault/StatefulSet-vault.yaml

@@ -58,8 +58,8 @@ spec:
           resources:
             requests:
               cpu: 50m
-              memory: 512Mi
+              memory: 90Mi
-          image: hashicorp/vault:1.21.4
+          image: hashicorp/vault:1.21.4@sha256:4e33b126a59c0c333b76fb4e894722462659a6bec7c48c9ee8cea56fccfd2569
           imagePullPolicy: IfNotPresent
           command:
             - "/bin/sh"
@@ -101,11 +101,9 @@ spec:
               value: "https://$(HOSTNAME).vault-internal:8201"
             - name: HOME
               value: "/home/vault"
-            - name: VAULT_LOG_LEVEL
-              value: "debug"
-            - name: VAULT_LOG_FORMAT
-              value: "standard"
           volumeMounts:
+            - name: audit
+              mountPath: /vault/audit
             - name: data
               mountPath: /vault/data
             - name: config
@@ -148,3 +146,15 @@ spec:
         resources:
           requests:
             storage: 1Gi
+        storageClassName: ceph-block
+    - apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: audit
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 5Gi
+        storageClassName: ceph-block

clusters/cl01tl/manifests/vaultwarden/Cluster-vaultwarden-postgresql-18-cluster.yaml

@@ -5,10 +5,10 @@ metadata:
   namespace: vaultwarden
   labels:
     app.kubernetes.io/name: vaultwarden-postgresql-18-cluster
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.2
     app.kubernetes.io/instance: vaultwarden
     app.kubernetes.io/part-of: vaultwarden
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.2"
     app.kubernetes.io/managed-by: Helm
 spec:
   instances: 3
@@ -26,8 +26,8 @@ spec:
     limits:
       hugepages-2Mi: 256Mi
     requests:
-      cpu: 100m
+      cpu: 20m
-      memory: 256Mi
+      memory: 80Mi
   affinity:
     enablePodAntiAffinity: true
     topologyKey: kubernetes.io/hostname

clusters/cl01tl/manifests/vaultwarden/Deployment-vaultwarden.yaml

@@ -64,13 +64,12 @@ spec:
                 secretKeyRef:
                   key: secret
                   name: vaultwarden-oidc-secret
-          image: vaultwarden/server:1.35.4
+          image: ghcr.io/vaultwarden/server:1.35.4@sha256:43498a94b22f9563f2a94b53760ab3e710eefc0d0cac2efda4b12b9eb8690664
-          imagePullPolicy: IfNotPresent
           name: main
           resources:
             requests:
               cpu: 10m
-              memory: 128Mi
+              memory: 30Mi
           volumeMounts:
             - mountPath: /data
               name: config

clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-oidc-secret.yaml

@@ -14,15 +14,9 @@ spec:
   data:
     - secretKey: client
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/vaultwarden
-        metadataPolicy: None
         property: client
     - secretKey: secret
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/vaultwarden
-        metadataPolicy: None
         property: secret

clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-postgresql-18-backup-garage-local-secret.yaml

@@ -5,10 +5,10 @@ metadata:
   namespace: vaultwarden
   labels:
     app.kubernetes.io/name: vaultwarden-postgresql-18-backup-garage-local-secret
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.2
     app.kubernetes.io/instance: vaultwarden
     app.kubernetes.io/part-of: vaultwarden
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.2"
     app.kubernetes.io/managed-by: Helm
 spec:
   secretStoreRef:

clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-postgresql-18-recovery-secret.yaml

@@ -4,10 +4,10 @@ metadata:
   name: vaultwarden-postgresql-18-recovery-secret
   namespace: vaultwarden
   labels:
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.2
     app.kubernetes.io/instance: vaultwarden
     app.kubernetes.io/part-of: vaultwarden
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.2"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: vaultwarden-postgresql-18-recovery-secret
 spec:

clusters/cl01tl/manifests/vaultwarden/ObjectStore-vaultwarden-postgresql-18-backup-garage-local.yaml

@@ -5,10 +5,10 @@ metadata:
   namespace: vaultwarden
   labels:
     app.kubernetes.io/name: vaultwarden-postgresql-18-backup-garage-local
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.2
     app.kubernetes.io/instance: vaultwarden
     app.kubernetes.io/part-of: vaultwarden
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.2"
     app.kubernetes.io/managed-by: Helm
 spec:
   retentionPolicy: 7d

clusters/cl01tl/manifests/vaultwarden/ObjectStore-vaultwarden-postgresql-18-recovery.yaml

@@ -4,10 +4,10 @@ metadata:
   name: "vaultwarden-postgresql-18-recovery"
   namespace: vaultwarden
   labels:
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.2
     app.kubernetes.io/instance: vaultwarden
     app.kubernetes.io/part-of: vaultwarden
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.2"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: "vaultwarden-postgresql-18-recovery"
 spec:

clusters/cl01tl/manifests/vaultwarden/PersistentVolumeClaim-vaultwarden-data.yaml

@@ -7,8 +7,6 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: vaultwarden
     helm.sh/chart: vaultwarden-4.6.2
-  annotations:
-    helm.sh/resource-policy: keep
   namespace: vaultwarden
 spec:
   accessModes:

clusters/cl01tl/manifests/vaultwarden/PrometheusRule-vaultwarden-postgresql-18-alert-rules.yaml

@@ -5,10 +5,10 @@ metadata:
   namespace: vaultwarden
   labels:
     app.kubernetes.io/name: vaultwarden-postgresql-18-alert-rules
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.2
     app.kubernetes.io/instance: vaultwarden
     app.kubernetes.io/part-of: vaultwarden
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.2"
     app.kubernetes.io/managed-by: Helm
 spec:
   groups:

clusters/cl01tl/manifests/vaultwarden/ScheduledBackup-vaultwarden-postgresql-18-scheduled-backup-live-backup.yaml

@@ -5,10 +5,10 @@ metadata:
   namespace: vaultwarden
   labels:
     app.kubernetes.io/name: "vaultwarden-postgresql-18-scheduled-backup-live-backup"
-    helm.sh/chart: postgres-18-cluster-7.10.0
+    helm.sh/chart: postgres-18-cluster-7.11.2
     app.kubernetes.io/instance: vaultwarden
     app.kubernetes.io/part-of: vaultwarden
-    app.kubernetes.io/version: "7.10.0"
+    app.kubernetes.io/version: "7.11.2"
     app.kubernetes.io/managed-by: Helm
 spec:
   immediate: true

clusters/cl01tl/manifests/version-checker/Deployment-version-checker.yaml

@@ -45,7 +45,7 @@ spec:
           resources:
             requests:
               cpu: 1m
-              memory: 40Mi
+              memory: 400Mi
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:

clusters/cl01tl/manifests/version-checker/ServiceMonitor-version-checker.yaml

@@ -0,0 +1,16 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: version-checker
+  namespace: version-checker
+  labels:
+    app.kubernetes.io/name: version-checker
+    app.kubernetes.io/instance: version-checker
+    app.kubernetes.io/part-of: version-checker
+spec:
+  selector:
+    matchLabels:
+      app: version-checker
+  endpoints:
+    - port: web
+      path: /metrics

clusters/cl01tl/manifests/volsync/Deployment-volsync.yaml

@@ -47,7 +47,7 @@ spec:
             - --metrics-require-rbac=false
           command:
             - /manager
-          image: "quay.io/backube/volsync:0.15.0"
+          image: "0.15.0@sha256:4fedd41b3101dde090542009c4177f703d241bf4760d1767bd9df08fd8fd93a4"
           imagePullPolicy: IfNotPresent
           env:
             - name: VOLSYNC_NAMESPACE
@@ -67,12 +67,10 @@ spec:
             initialDelaySeconds: 5
             periodSeconds: 10
           resources:
-            limits:
+            limits: {}
-              cpu: 1000m
-              memory: 1Gi
             requests:
-              cpu: 10m
+              cpu: 1m
-              memory: 128Mi
+              memory: 80Mi
           securityContext:
             allowPrivilegeEscalation: false
             capabilities: