clusters/cl01tl/manifests/foldergram/Deployment-foldergram.yaml

@@ -29,6 +29,9 @@ spec:
       enableServiceLinks: false
       serviceAccountName: default
       automountServiceAccountToken: true
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
       hostIPC: false
       hostNetwork: false
       hostPID: false

clusters/cl01tl/manifests/gatus/Deployment-gatus.yaml

@@ -13,13 +13,13 @@ metadata:
     reloader.stakater.com/auto: "true"
 spec:
   replicas: 1
-  revisionHistoryLimit: 10
+  revisionHistoryLimit: 3
   selector:
     matchLabels:
       app.kubernetes.io/name: gatus
       app.kubernetes.io/instance: gatus
   strategy:
-    type: Recreate
+    type: RollingUpdate
   template:
     metadata:
       labels:
@@ -39,7 +39,7 @@ spec:
             runAsGroup: 65534
             runAsNonRoot: true
             runAsUser: 65534
-          image: "ghcr.io/twin/gatus:v5.35.0"
+          image: "ghcr.io/twin/gatus:v5.35.0@sha256:21609f31be8c4e680ce3004b24276305666239c99aff58391503f3fb6142f39d"
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
@@ -100,7 +100,7 @@ spec:
           resources:
             requests:
               cpu: 10m
-              memory: 128Mi
+              memory: 20Mi
           volumeMounts:
             - name: gatus-config
               mountPath: /config

clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-config-secret.yaml

@@ -14,8 +14,5 @@ spec:
   data:
     - secretKey: NTFY_TOKEN
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /ntfy/user/cl01tl
-        metadataPolicy: None
         property: token

clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-oidc-secret.yaml

@@ -14,15 +14,9 @@ spec:
   data:
     - secretKey: OIDC_CLIENT_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/gatus
-        metadataPolicy: None
         property: client
     - secretKey: OIDC_CLIENT_SECRET
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/gatus
-        metadataPolicy: None
         property: secret

clusters/cl01tl/manifests/gitea/Cluster-gitea-postgresql-18-cluster.yaml

@@ -26,8 +26,8 @@ spec:
     limits:
       hugepages-2Mi: 256Mi
     requests:
-      cpu: 200m
+      cpu: 100m
-      memory: 1Gi
+      memory: 100Mi
   affinity:
     enablePodAntiAffinity: true
     topologyKey: kubernetes.io/hostname

clusters/cl01tl/manifests/gitea/Deployment-gitea.yaml

@@ -9,15 +9,15 @@ metadata:
     app: gitea
     app.kubernetes.io/name: gitea
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.25.5"
+    app.kubernetes.io/version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
-    version: "1.25.5"
+    version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 3
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxUnavailable: 0
+      maxUnavailable: 1
       maxSurge: 100%
   selector:
     matchLabels:
@@ -26,22 +26,22 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: 878b6957d244540764fe2218a124d9617a7d00acd64d1837f28805cdc5881739
+        checksum/config: b9d1223f0868e9701a10c61b13b4494578cbfe76301131a71a7196eebd8ec872
         checksum/oauth_0: 03073bf48e66f48f622bd02092a5f93bfd06dbcb5fd833aded3b0d40980be93d
       labels:
         helm.sh/chart: gitea-12.5.0
         app: gitea
         app.kubernetes.io/name: gitea
         app.kubernetes.io/instance: gitea
-        app.kubernetes.io/version: "1.25.5"
+        app.kubernetes.io/version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
-        version: "1.25.5"
+        version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
         app.kubernetes.io/managed-by: Helm
     spec:
       securityContext:
         fsGroup: 1000
       initContainers:
         - name: init-directories
-          image: "registry.hub.docker.com/gitea/gitea:1.25.5-rootless"
+          image: "registry.hub.docker.com/gitea/gitea:1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472-rootless"
           imagePullPolicy: IfNotPresent
           command:
             - "/usr/sbinx/init_directory_structure.sh"
@@ -71,7 +71,7 @@ spec:
               cpu: 100m
               memory: 128Mi
         - name: init-app-ini
-          image: "registry.hub.docker.com/gitea/gitea:1.25.5-rootless"
+          image: "registry.hub.docker.com/gitea/gitea:1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472-rootless"
           imagePullPolicy: IfNotPresent
           command:
             - "/usr/sbinx/config_environment.sh"
@@ -132,7 +132,7 @@ spec:
               cpu: 100m
               memory: 128Mi
         - name: configure-gitea
-          image: "registry.hub.docker.com/gitea/gitea:1.25.5-rootless"
+          image: "registry.hub.docker.com/gitea/gitea:1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472-rootless"
           command:
             - "/usr/sbinx/configure_gitea.sh"
           imagePullPolicy: IfNotPresent
@@ -183,7 +183,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: gitea
-          image: "registry.hub.docker.com/gitea/gitea:1.25.5-rootless"
+          image: "registry.hub.docker.com/gitea/gitea:1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472-rootless"
           imagePullPolicy: IfNotPresent
           env:
             - name: SSH_LISTEN_PORT
@@ -225,7 +225,10 @@ spec:
             tcpSocket:
               port: http
             timeoutSeconds: 1
-          resources: {}
+          resources:
+            requests:
+              cpu: 1000m
+              memory: 600Mi
           securityContext: {}
           volumeMounts:
             - name: temp

clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-admin-secret.yaml

@@ -14,15 +14,9 @@ spec:
   data:
     - secretKey: username
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/gitea/auth/admin
-        metadataPolicy: None
         property: username
     - secretKey: password
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/gitea/auth/admin
-        metadataPolicy: None
         property: password

clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-meilisearch-master-key-secret.yaml

@@ -20,8 +20,5 @@ spec:
   data:
     - secretKey: MEILI_MASTER_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/gitea/meilisearch
-        metadataPolicy: None
         property: MEILI_MASTER_KEY

clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-oidc-secret.yaml

@@ -14,15 +14,9 @@ spec:
   data:
     - secretKey: secret
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/gitea
-        metadataPolicy: None
         property: secret
     - secretKey: key
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /authentik/oidc/gitea
-        metadataPolicy: None
         property: client

clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-renovate-secret.yaml

@@ -14,36 +14,21 @@ spec:
   data:
     - secretKey: RENOVATE_ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/gitea/renovate
-        metadataPolicy: None
         property: RENOVATE_ENDPOINT
     - secretKey: RENOVATE_GIT_AUTHOR
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/gitea/renovate
-        metadataPolicy: None
         property: RENOVATE_GIT_AUTHOR
     - secretKey: RENOVATE_TOKEN
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/gitea/renovate
-        metadataPolicy: None
         property: RENOVATE_TOKEN
     - secretKey: RENOVATE_GIT_PRIVATE_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/gitea/renovate
-        metadataPolicy: None
         property: id_rsa
     - secretKey: RENOVATE_GITHUB_COM_TOKEN
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /github/gitea-cl01tl
-        metadataPolicy: None
         property: token

clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-renovate-ssh-secret.yaml

@@ -14,22 +14,13 @@ spec:
   data:
     - secretKey: config
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/gitea/renovate
-        metadataPolicy: None
         property: ssh_config
     - secretKey: id_rsa
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/gitea/renovate
-        metadataPolicy: None
         property: id_rsa
     - secretKey: id_rsa.pub
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/gitea/renovate
-        metadataPolicy: None
         property: id_rsa.pub

clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-runner-secret.yaml

@@ -14,8 +14,5 @@ spec:
   data:
     - secretKey: token
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /cl01tl/gitea/runner
-        metadataPolicy: None
         property: token

clusters/cl01tl/manifests/gitea/Pod-gitea-test-connection.yaml

@@ -8,8 +8,8 @@ metadata:
     app: gitea
     app.kubernetes.io/name: gitea
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.25.5"
+    app.kubernetes.io/version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
-    version: "1.25.5"
+    version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
     app.kubernetes.io/managed-by: Helm
   annotations:
     "helm.sh/hook": test-success

clusters/cl01tl/manifests/gitea/Secret-gitea-init.yaml

@@ -8,8 +8,8 @@ metadata:
     app: gitea
     app.kubernetes.io/name: gitea
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.25.5"
+    app.kubernetes.io/version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
-    version: "1.25.5"
+    version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
     app.kubernetes.io/managed-by: Helm
 type: Opaque
 stringData:

clusters/cl01tl/manifests/gitea/Secret-gitea-inline-config.yaml

@@ -8,8 +8,8 @@ metadata:
     app: gitea
     app.kubernetes.io/name: gitea
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.25.5"
+    app.kubernetes.io/version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
-    version: "1.25.5"
+    version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
     app.kubernetes.io/managed-by: Helm
 type: Opaque
 stringData:

clusters/cl01tl/manifests/gitea/Secret-gitea.yaml

@@ -8,8 +8,8 @@ metadata:
     app: gitea
     app.kubernetes.io/name: gitea
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.25.5"
+    app.kubernetes.io/version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
-    version: "1.25.5"
+    version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
     app.kubernetes.io/managed-by: Helm
 type: Opaque
 stringData:

clusters/cl01tl/manifests/gitea/Service-gitea-http.yaml

@@ -8,8 +8,8 @@ metadata:
     app: gitea
     app.kubernetes.io/name: gitea
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.25.5"
+    app.kubernetes.io/version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
-    version: "1.25.5"
+    version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
     app.kubernetes.io/managed-by: Helm
   annotations: {}
 spec:

clusters/cl01tl/manifests/gitea/Service-gitea-ssh.yaml

@@ -8,8 +8,8 @@ metadata:
     app: gitea
     app.kubernetes.io/name: gitea
     app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.25.5"
+    app.kubernetes.io/version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
-    version: "1.25.5"
+    version: "1.25.5@sha256:f846d26a4fc389c5806a580a765e00bfdd1fd181e6f2060da98ea2669d914472"
     app.kubernetes.io/managed-by: Helm
   annotations: {}
 spec:

clusters/cl01tl/manifests/gitea/StatefulSet-gitea-gitea-actions-act-runner.yaml

@@ -34,7 +34,7 @@ spec:
       securityContext: {}
       initContainers:
         - name: init-gitea
-          image: "busybox:1.37.0"
+          image: "registry.hub.docker.com/busybox:1.37.0@sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e"
           command:
             - sh
             - -c
@@ -46,7 +46,7 @@ spec:
               done
               echo "Gitea has been reached!"
         - name: dind
-          image: "docker:28.3.3-dind"
+          image: "registry.hub.docker.com/docker:29.3.1-dind@sha256:4d90f1f6c400315c2dba96d3ec93c01e64198395cbba04f79d12adce4f737029"
           imagePullPolicy: IfNotPresent
           restartPolicy: Always
           securityContext:
@@ -69,7 +69,7 @@ spec:
               name: docker-socket
       containers:
         - name: act-runner
-          image: "gitea/act_runner:0.2.13"
+          image: "registry.hub.docker.com/gitea/act_runner:0.3.1@sha256:c2a169c5e99864c25e32527cef3d82203225e09558773022bf3dc164a2e6d762"
           imagePullPolicy: IfNotPresent
           workingDir: /data
           env:
@@ -107,4 +107,4 @@ spec:
         accessModes: ["ReadWriteOnce"]
         resources:
           requests:
-            storage: 5Gi
+            storage: 10Gi

clusters/cl01tl/manifests/gitea/StatefulSet-gitea-meilisearch.yaml

@@ -91,5 +91,5 @@ spec:
             timeoutSeconds: 10
           resources:
             requests:
-              cpu: 10m
+              cpu: 1m
-              memory: 128Mi
+              memory: 160Mi

clusters/cl01tl/manifests/gitea/StatefulSet-gitea-valkey.yaml

@@ -95,7 +95,7 @@ spec:
           resources:
             requests:
               cpu: 20m
-              memory: 256Mi
+              memory: 2Gi
           volumeMounts:
             - name: valkey-data
               mountPath: /data

clusters/cl01tl/manifests/site-documentation/Deployment-site-documentation.yaml

@@ -34,7 +34,7 @@ spec:
       hostPID: false
       dnsPolicy: ClusterFirst
       containers:
-        - image: harbor.alexlebens.net/images/site-documentation:0.10.0
+        - image: harbor.alexlebens.net/images/site-documentation:0.11.0
           imagePullPolicy: IfNotPresent
           name: main
           resources: