chore(deps): update registry.k8s.io/sig-storage/csi-provisioner docker tag to v5

argocd/kustomization.yaml

@@ -13,7 +13,7 @@ resources:
 images:
   - name: argocd
     newName: code.icb4dc0.de/infrastructure/images/argocd
-    newTag: v2.11.2
+    newTag: v2.12.0
 
 labels:
 - includeSelectors: true
@@ -26,7 +26,7 @@ helmCharts:
     repo: https://argoproj.github.io/argo-helm
     releaseName: argo-cd
     namespace: argo-system
-    version: "7.1.1"
+    version: "7.4.1"
     valuesFile: config/values.argo-cd.yaml
     apiVersions:
       - monitoring.coreos.com/v1

argocd/resources/dragonfly.yml

@@ -9,6 +9,8 @@ metadata:
     app.kubernetes.io/part-of: argo-cd
 spec:
   replicas: 2
+  nodeSelector:
+    kubernetes.io/arch: arm64
   resources:
     requests:
       cpu: 50m

cert-manager/kustomization.yaml

@@ -12,7 +12,7 @@ resources:
 helmCharts:
   - name: cert-manager
     repo: https://charts.jetstack.io
-    version: "v1.14.5"
+    version: "v1.15.2"
     releaseName: cert-manager
     namespace: kube-system
     valuesFile: config/values.cert-manager.yaml

cnpg/.gitattributes

@@ -0,0 +1 @@
+**/secrets/*.y*ml filter=age diff=age merge=age -text

cnpg/config/values.cnpg.yaml

@@ -0,0 +1,7 @@
+replicaCount: 2
+
+monitoring:
+  podMonitorEnabled: true
+  grafanaDashboard:
+    create: true
+    namespace: observability-system

cnpg/config/values.ext-pgo.yaml

@@ -0,0 +1,3 @@
+replicaCount: 2
+
+existingSecret: ext-postgres-operator

cnpg/kustomization.yaml

@@ -0,0 +1,23 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - resources/secrets/ext-pgo-creds.yaml
+  - resources/secrets/ext-pgo-admin.yaml
+  - resources/secrets/cnpg-backup-creds.yaml
+  - resources/cluster.yaml
+
+helmCharts:
+  - releaseName: cnpg
+    name: cloudnative-pg
+    repo: https://cloudnative-pg.github.io/charts
+    version: 0.21.6
+    valuesFile: config/values.cnpg.yaml
+    namespace: postgres-system
+
+  - releaseName: ext-pgo
+    name: ext-postgres-operator
+    repo: https://movetokube.github.io/postgres-operator/
+    version: 1.2.6
+    valuesFile: config/values.ext-pgo.yaml
+    namespace: postgres

cnpg/resources/cluster.yaml

@@ -0,0 +1,48 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: app-cluster
+  namespace: postgres
+spec:
+  instances: 2
+
+  managed:
+    roles:
+      - name: ext_pgo_admin
+        ensure: present
+        superuser: true
+        createrole: true
+        createdb: true
+
+  storage:
+    size: 10Gi
+    storageClass: hcloud-volumes
+
+  backup:
+    barmanObjectStore:
+      destinationPath: cnpg
+      s3Credentials:
+        accessKeyId:
+          name: cnpg-backup-creds
+          key: ACCESS_KEY_ID
+        secretAccessKey:
+          name: cnpg-backup-creds
+          key: ACCESS_SECRET_KEY
+    retentionPolicy: "30d"
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 400Mi
+    limits:
+      cpu: 500m
+      memory: 800Mi
+
+  affinity:
+    enablePodAntiAffinity: true
+    topologyKey: kubernetes.io/hostname
+    podAntiAffinityType: preferred
+
+  enablePDB: true
+  monitoring:
+    enablePodMonitor: true

cnpg/resources/secrets/ext-pgo-admin.yaml

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> X25519 SQkKLcgCsGBZ6FM800HldDftkLV/u53xliCGnGU6Gz0
+TvQkvxIdoIydgUshJXYai2pJjo/GsEklyGfba/zj31Y
+-> X25519 V60zpoLahYcT/dGVnixvv471qCE8xAOP+LoAdq04ryM
+q7iTcIfP6xgpJaQZJuW0kpY9dEwbwsleyyorsFK4atA
+--- W40yHxyT9ZMPvnQ0WYg7K1sG0qd4loHmyW6HYZL5zBM
+#Wøü5+D`é‚H‹UŠdNSÆ<53>f.vC]uÎö•ù"¼ègÙÝüfp:¬<C2AC>ϬNB”æ<E2809D>vúõè¢	O%3cÖòQü9m(ÓEäùØKµ×4ÞÌùgÜžo&€vztëPÞˆþñ2	ºª––
<02>æð>&Z{Î'<27>§QôÉj<C389>Ä:ƒ¡¶ø܈‡
	ƒæ"Céœk‹¤£ÚÄ)Þ‰V1åÎÏV]
+¥å·õñÄ'°s¨w±~ÊoEƒûæ•F¾hÍS	7¤‘}'&[–ÞlÍÝÖUM×îÃ=ÿwŽ

coder/kustomization.yaml

@@ -13,6 +13,6 @@ helmCharts:
     repo: https://helm.coder.com/v2
     releaseName: coder
     namespace: coder
-    version: "2.11.2"
+    version: "2.13.3"
     valuesFile: config/values.coder.yml
     skipTests: true

contour/kustomization.yaml

@@ -6,7 +6,7 @@ namespace: projectcontour
 images:
 - name: contour
   newName: ghcr.io/projectcontour/contour
-  newTag: v1.29.0
+  newTag: v1.30.0
 
 resources:
   - crds/contour.yaml

dragonfly-operator/kustomization.yaml

@@ -9,7 +9,7 @@ images:
   newTag: v0.16.0
 - name: dragonfly-operator
   newName: docker.dragonflydb.io/dragonflydb/operator
-  newTag: v1.1.2
+  newTag: v1.1.6
 
 
 resources:

dragonfly-operator/resources/crd/dragonfly.yaml

@@ -1,4 +1,3 @@
----
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
@@ -35,6 +34,24 @@ spec:
           spec:
             description: DragonflySpec defines the desired state of Dragonfly
             properties:
+              aclFromSecret:
+                description: (Optional) Acl file Secret to pass to the container
+                properties:
+                  key:
+                    description: The key of the secret to select from.  Must be a
+                      valid secret key.
+                    type: string
+                  name:
+                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                      TODO: Add other useful fields. apiVersion, kind, uid?'
+                    type: string
+                  optional:
+                    description: Specify whether the Secret or its key must be defined
+                    type: boolean
+                required:
+                - key
+                type: object
+                x-kubernetes-map-type: atomic
               affinity:
                 description: (Optional) Dragonfly pod affinity
                 properties:
@@ -1031,6 +1048,23 @@ spec:
               image:
                 description: Image is the Dragonfly image to use
                 type: string
+              labels:
+                additionalProperties:
+                  type: string
+                description: (Optional) Labels to add to the Dragonfly pods.
+                type: object
+              memcachedPort:
+                description: (Optional) Dragonfly memcached port
+                format: int32
+                type: integer
+              nodeSelector:
+                additionalProperties:
+                  type: string
+                description: (Optional) Dragonfly pod node selector
+                type: object
+              priorityClassName:
+                description: (Optional) Dragonfly pod priority class name
+                type: string
               replicas:
                 description: Replicas is the total number of Dragonfly instances including
                   the master
@@ -1095,10 +1129,23 @@ spec:
                       type: string
                     description: (Optional) Dragonfly Service Annotations
                     type: object
+                  labels:
+                    additionalProperties:
+                      type: string
+                    description: (Optional) Dragonfly Service Labels
+                    type: object
+                  name:
+                    description: (Optional) Dragonfly Service name
+                    type: string
                   type:
                     description: (Optional) Dragonfly Service type
                     type: string
                 type: object
+              skipFSGroup:
+                description: (Optional) Skip Assigning FileSystem Group. Required
+                  for platforms such as Openshift that require IDs to not be set,
+                  as it injects a fixed randomized ID per namespace into all pods.
+                type: boolean
               snapshot:
                 description: (Optional) Dragonfly Snapshot configuration
                 properties:
@@ -1374,6 +1421,174 @@ spec:
                       type: string
                   type: object
                 type: array
+              topologySpreadConstraints:
+                description: (Optional) Dragonfly pod topologySpreadConstraints
+                items:
+                  description: TopologySpreadConstraint specifies how to spread matching
+                    pods among the given topology.
+                  properties:
+                    labelSelector:
+                      description: LabelSelector is used to find matching pods. Pods
+                        that match this label selector are counted to determine the
+                        number of pods in their corresponding topology domain.
+                      properties:
+                        matchExpressions:
+                          description: matchExpressions is a list of label selector
+                            requirements. The requirements are ANDed.
+                          items:
+                            description: A label selector requirement is a selector
+                              that contains values, a key, and an operator that relates
+                              the key and values.
+                            properties:
+                              key:
+                                description: key is the label key that the selector
+                                  applies to.
+                                type: string
+                              operator:
+                                description: operator represents a key's relationship
+                                  to a set of values. Valid operators are In, NotIn,
+                                  Exists and DoesNotExist.
+                                type: string
+                              values:
+                                description: values is an array of string values.
+                                  If the operator is In or NotIn, the values array
+                                  must be non-empty. If the operator is Exists or
+                                  DoesNotExist, the values array must be empty. This
+                                  array is replaced during a strategic merge patch.
+                                items:
+                                  type: string
+                                type: array
+                            required:
+                            - key
+                            - operator
+                            type: object
+                          type: array
+                        matchLabels:
+                          additionalProperties:
+                            type: string
+                          description: matchLabels is a map of {key,value} pairs.
+                            A single {key,value} in the matchLabels map is equivalent
+                            to an element of matchExpressions, whose key field is
+                            "key", the operator is "In", and the values array contains
+                            only "value". The requirements are ANDed.
+                          type: object
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    matchLabelKeys:
+                      description: MatchLabelKeys is a set of pod label keys to select
+                        the pods over which spreading will be calculated. The keys
+                        are used to lookup values from the incoming pod labels, those
+                        key-value labels are ANDed with labelSelector to select the
+                        group of existing pods over which spreading will be calculated
+                        for the incoming pod. Keys that don't exist in the incoming
+                        pod labels will be ignored. A null or empty list means only
+                        match against labelSelector.
+                      items:
+                        type: string
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    maxSkew:
+                      description: 'MaxSkew describes the degree to which pods may
+                        be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`,
+                        it is the maximum permitted difference between the number
+                        of matching pods in the target topology and the global minimum.
+                        The global minimum is the minimum number of matching pods
+                        in an eligible domain or zero if the number of eligible domains
+                        is less than MinDomains. For example, in a 3-zone cluster,
+                        MaxSkew is set to 1, and pods with the same labelSelector
+                        spread as 2/2/1: In this case, the global minimum is 1. |
+                        zone1 | zone2 | zone3 | |  P P  |  P P  |   P   | - if MaxSkew
+                        is 1, incoming pod can only be scheduled to zone3 to become
+                        2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1)
+                        on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming
+                        pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`,
+                        it is used to give higher precedence to topologies that satisfy
+                        it. It''s a required field. Default value is 1 and 0 is not
+                        allowed.'
+                      format: int32
+                      type: integer
+                    minDomains:
+                      description: "MinDomains indicates a minimum number of eligible
+                        domains. When the number of eligible domains with matching
+                        topology keys is less than minDomains, Pod Topology Spread
+                        treats \"global minimum\" as 0, and then the calculation of
+                        Skew is performed. And when the number of eligible domains
+                        with matching topology keys equals or greater than minDomains,
+                        this value has no effect on scheduling. As a result, when
+                        the number of eligible domains is less than minDomains, scheduler
+                        won't schedule more than maxSkew Pods to those domains. If
+                        value is nil, the constraint behaves as if MinDomains is equal
+                        to 1. Valid values are integers greater than 0. When value
+                        is not nil, WhenUnsatisfiable must be DoNotSchedule. \n For
+                        example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains
+                        is set to 5 and pods with the same labelSelector spread as
+                        2/2/2: | zone1 | zone2 | zone3 | |  P P  |  P P  |  P P  |
+                        The number of domains is less than 5(MinDomains), so \"global
+                        minimum\" is treated as 0. In this situation, new pod with
+                        the same labelSelector cannot be scheduled, because computed
+                        skew will be 3(3 - 0) if new Pod is scheduled to any of the
+                        three zones, it will violate MaxSkew. \n This is a beta field
+                        and requires the MinDomainsInPodTopologySpread feature gate
+                        to be enabled (enabled by default)."
+                      format: int32
+                      type: integer
+                    nodeAffinityPolicy:
+                      description: "NodeAffinityPolicy indicates how we will treat
+                        Pod's nodeAffinity/nodeSelector when calculating pod topology
+                        spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector
+                        are included in the calculations. - Ignore: nodeAffinity/nodeSelector
+                        are ignored. All nodes are included in the calculations. \n
+                        If this value is nil, the behavior is equivalent to the Honor
+                        policy. This is a beta-level feature default enabled by the
+                        NodeInclusionPolicyInPodTopologySpread feature flag."
+                      type: string
+                    nodeTaintsPolicy:
+                      description: "NodeTaintsPolicy indicates how we will treat node
+                        taints when calculating pod topology spread skew. Options
+                        are: - Honor: nodes without taints, along with tainted nodes
+                        for which the incoming pod has a toleration, are included.
+                        - Ignore: node taints are ignored. All nodes are included.
+                        \n If this value is nil, the behavior is equivalent to the
+                        Ignore policy. This is a beta-level feature default enabled
+                        by the NodeInclusionPolicyInPodTopologySpread feature flag."
+                      type: string
+                    topologyKey:
+                      description: TopologyKey is the key of node labels. Nodes that
+                        have a label with this key and identical values are considered
+                        to be in the same topology. We consider each <key, value>
+                        as a "bucket", and try to put balanced number of pods into
+                        each bucket. We define a domain as a particular instance of
+                        a topology. Also, we define an eligible domain as a domain
+                        whose nodes meet the requirements of nodeAffinityPolicy and
+                        nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname",
+                        each Node is a domain of that topology. And, if TopologyKey
+                        is "topology.kubernetes.io/zone", each zone is a domain of
+                        that topology. It's a required field.
+                      type: string
+                    whenUnsatisfiable:
+                      description: 'WhenUnsatisfiable indicates how to deal with a
+                        pod if it doesn''t satisfy the spread constraint. - DoNotSchedule
+                        (default) tells the scheduler not to schedule it. - ScheduleAnyway
+                        tells the scheduler to schedule the pod in any location, but
+                        giving higher precedence to topologies that would help reduce
+                        the skew. A constraint is considered "Unsatisfiable" for an
+                        incoming pod if and only if every possible node assignment
+                        for that pod would violate "MaxSkew" on some topology. For
+                        example, in a 3-zone cluster, MaxSkew is set to 1, and pods
+                        with the same labelSelector spread as 3/1/1: | zone1 | zone2
+                        | zone3 | | P P P |   P   |   P   | If WhenUnsatisfiable is
+                        set to DoNotSchedule, incoming pod can only be scheduled to
+                        zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on
+                        zone2(zone3) satisfies MaxSkew(1). In other words, the cluster
+                        can still be imbalanced, but scheduler won''t make it *more*
+                        imbalanced. It''s a required field.'
+                      type: string
+                  required:
+                  - maxSkew
+                  - topologyKey
+                  - whenUnsatisfiable
+                  type: object
+                type: array
             type: object
           status:
             description: DragonflyStatus defines the observed state of Dragonfly
@@ -1394,4 +1609,4 @@ spec:
     served: true
     storage: true
     subresources:
-      status: {}
+      status: {}

ente/kustomization.yaml

@@ -7,13 +7,13 @@ namePrefix: ente-
 images:
   - name: museum
     newName: ghcr.io/ente-io/server
-    newTag: 26e17d8464736acc747c1b35c65af194172a245c
+    newTag: cdbf8c5f0971cb383df03c6b2f72ffb85387beef
   - name: photos
     newName: code.icb4dc0.de/infrastructure/images/ente/photos
-    newTag: photos-v0.8.94
+    newTag: v0.9.16
   - name: cast
     newName: code.icb4dc0.de/infrastructure/images/ente/cast
-    newTag: photos-v0.8.94
+    newTag: v0.9.16
 
 labels:
 - includeSelectors: true
@@ -39,4 +39,4 @@ configMapGenerator:
 secretGenerator:
   - name: museum-credentials
     files:
-      - config/credentials.yaml
+      - config/credentials.yaml

ente/resources/cast/deployment.yaml

@@ -1,3 +1,4 @@
+# yaml-language-server: $scheme=https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/v1.30.2-standalone-strict/deployment-apps-v1.json
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -33,5 +34,10 @@ spec:
         ports:
         - name: http
           containerPort: 3000
+        readinessProbe:
+          httpGet:
+            port: 3000
+            path: /
+            scheme: HTTP
       nodeSelector:
         kubernetes.io/arch: arm64

ente/resources/photos/deployment.yaml

@@ -1,3 +1,4 @@
+# yaml-language-server: $scheme=https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/v1.30.2-standalone-strict/deployment-apps-v1.json
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -33,5 +34,10 @@ spec:
         ports:
         - name: http
           containerPort: 3000
+        readinessProbe:
+          httpGet:
+            port: 3000
+            path: /
+            scheme: HTTP
       nodeSelector:
         kubernetes.io/arch: arm64

forgejo/kustomization.yaml

@@ -12,10 +12,10 @@ labels:
 images:
   - name: act_runner
     newName: code.forgejo.org/forgejo/runner
-    newTag: "3.4.1"
+    newTag: "3.5.0"
   - name: dind
     newName: docker
-    newTag: 26.1.3-dind
+    newTag: 27.1.1-dind
 
 resources:
   - resources/secrets/admin-credentials.yaml
@@ -46,7 +46,7 @@ helmCharts:
     repo: oci://codeberg.org/forgejo-contrib
     releaseName: forgejo
     namespace: forgejo
-    version: "7.0.0"
+    version: "8.1.0"
     valuesFile: config/values.forgejo.yaml
     skipTests: true
     apiVersions:
@@ -55,6 +55,6 @@ helmCharts:
     repo: https://meilisearch.github.io/meilisearch-kubernetes
     releaseName: forgejo-indexer
     namespace: forgejo
-    version: "0.7.0"
+    version: "0.8.0"
     valuesFile: config/values.meilisearch.yaml
     skipTests: true

forgejo/resources/dragonfly.yml

@@ -9,6 +9,8 @@ metadata:
     app.kubernetes.io/part-of: forgejo
 spec:
   replicas: 2
+  nodeSelector:
+    kubernetes.io/arch: arm64
   resources:
     requests:
       cpu: 100m

garage/backup/kustomization.yaml

@@ -6,7 +6,7 @@ namespace: garage
 images:
   - name: rclone
     newName: rclone/rclone
-    newTag: "1.66"
+    newTag: "1.67"
 
 resources:
 - resources/cronjob.yaml

garage/resources/workload.yaml

@@ -48,8 +48,16 @@ spec:
             cpu: 300m
             memory: 280Mi
           limits:
-            cpu: 300m
+            cpu: 750m
             memory: 500Mi
+        readinessProbe:
+          httpGet:
+            port: 3903
+            path: /health
+        livenessProbe:
+          httpGet:
+            port: 3903
+            path: /health
         securityContext:
           capabilities:
             drop:

hcloud/kustomization.yaml

@@ -12,12 +12,12 @@ helmCharts:
     repo: https://charts.hetzner.cloud
     releaseName: hccm
     namespace: kube-system
-    version: "1.19.0"
+    version: "1.20.0"
     valuesFile: config/values.ccm.yaml
 
   - name: hcloud-csi
     repo: https://charts.hetzner.cloud
     releaseName: hcloud-csi-driver
     namespace: kube-system
-    version: "2.6.0"
+    version: "2.8.0"
     valuesFile: config/values.csi.yaml

kube-prometheus/config/values.prometheus.yaml

@@ -13,6 +13,8 @@ defaultRules:
 prometheus:
   prometheusSpec:
     retention: 7d
+    nodeSelector:
+      kubernetes.io/arch: arm64
     serviceMonitorNamespaceSelector:
       matchLabels:
         prometheus: default
@@ -33,11 +35,11 @@ prometheus:
         prometheus: default
     resources:
       requests:
-        memory: 3Gi
+        memory: 1500Mi
         cpu: 500m
       limits:
-        memory: 4Gi
+        memory: 2200Mi
-        cpu:  800m
+        cpu: 800m
     storageSpec:
       volumeClaimTemplate:
         spec:
@@ -54,7 +56,7 @@ kubeEtcd:
 
 kubeControllerManager:
   enabled: true
-  endpoints: ['172.23.2.10']
+  endpoints: ["172.23.2.10"]
   service:
     enabled: true
     port: 10257
@@ -65,7 +67,7 @@ kubeControllerManager:
 
 kubeScheduler:
   enabled: false
-  endpoints: ['172.23.2.10']
+  endpoints: ["172.23.2.10"]
   service:
     enabled: true
     port: 10259
@@ -76,7 +78,7 @@ kubeScheduler:
 
 kubeProxy:
   enabled: false
-  endpoints: ['172.23.2.10']
+  endpoints: ["172.23.2.10"]
   service:
     enabled: true
     port: 10249
@@ -102,16 +104,16 @@ grafana:
     auth:
       disable_login_form: true
     auth.generic_oauth:
-        name: Forgejo
+      name: Forgejo
-        icon: signin
+      icon: signin
-        enabled: "true"
+      enabled: "true"
-        client_id: "${GF_OAUTH_CLIENT_ID}"
+      client_id: "${GF_OAUTH_CLIENT_ID}"
-        client_secret: "${GF_OAUTH_CLIENT_SECRET}"
+      client_secret: "${GF_OAUTH_CLIENT_SECRET}"
-        empty_scopes: true
+      empty_scopes: true
-        auth_url: https://code.icb4dc0.de/login/oauth/authorize
+      auth_url: https://code.icb4dc0.de/login/oauth/authorize
-        token_url: https://code.icb4dc0.de/login/oauth/access_token
+      token_url: https://code.icb4dc0.de/login/oauth/access_token
-        api_url: https://code.icb4dc0.de/login/oauth/userinfo
+      api_url: https://code.icb4dc0.de/login/oauth/userinfo
-        skip_org_role_sync: true
+      skip_org_role_sync: true
   persistence:
     enabled: false
     storageClassName: hcloud-volumes
@@ -128,4 +130,4 @@ kube-state-metrics:
   prometheus:
     monitor:
       additionalLabels:
-        prometheus: default
+        prometheus: default

kube-prometheus/kustomization.yaml

@@ -15,5 +15,5 @@ helmCharts:
     includeCRDs: true
     namespace: observability-system
     releaseName: prometheus
-    version: "59.1.0"
+    version: "61.7.1"
     valuesFile: config/values.prometheus.yaml

linkwarden/kustomization.yaml

@@ -11,7 +11,7 @@ labels:
 images:
   - name: linkwarden
     newName: ghcr.io/linkwarden/linkwarden
-    newTag: "v2.5.3"
+    newTag: "v2.6.2"
 
 resources:
   - "resources/namespace.yaml"

mariadb-operator/kustomization.yaml

@@ -11,7 +11,7 @@ helmCharts:
     releaseName: mariadb-operator
     repo: https://mariadb-operator.github.io/mariadb-operator
     namespace: mariadb-system
-    version: "0.28.1"
+    version: "0.29.0"
     valuesFile: config/mariadb-operator.values.yaml
     includeCRDs: true
     skipTests: true

nextcloud/kustomization.yaml

@@ -21,7 +21,7 @@ helmCharts:
     repo: https://nextcloud.github.io/helm/
     releaseName: nextcloud
     namespace: nextcloud
-    version: "4.6.10"
+    version: "5.5.2"
     valuesFile: config/values.nextcloud.yaml
     skipTests: true
 

nocodb/kustomization.yaml

@@ -6,7 +6,7 @@ namespace: nocodb
 images:
 - name: nocodb
   newName: docker.io/nocodb/nocodb
-  newTag: 0.207.3
+  newTag: 0.251.3
 
 labels:
 - includeSelectors: true

nocodb/resources/deployment.yaml

@@ -1,3 +1,4 @@
+# yaml-language-server: $scheme=https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/v1.30.2-standalone-strict/deployment-apps-v1.json
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -16,55 +17,53 @@ spec:
         app.kubernetes.io/name: nocodb
     spec:
       containers:
-      - name: nocodb
+        - name: nocodb
-        image: nocodb
+          image: nocodb
-        envFrom:
+          envFrom:
-          - secretRef:
+            - secretRef:
-              name: nocodb-config
+                name: nocodb-config
-        ports:
+          ports:
-        - containerPort: 8080
+            - containerPort: 8080
-          protocol: TCP
+              protocol: TCP
-          name: web
+              name: web
-        volumeMounts:
+          volumeMounts:
-          - mountPath: /usr/app/data
+            - name: nocodb-metadata
-            name: nocodb-metadata
+              mountPath: /usr/app/data
-          - mountPath: /usr/src/app/
+            - name: tmp
-            name: app-volume
+              mountPath: /tmp
-          - mountPath: /tmp
+          livenessProbe:
-            name: app-tmp
+            httpGet:
-        livenessProbe:
+              path: /api/v1/health
-          httpGet:
+              port: web
-            path: /api/v1/health
+              scheme: HTTP
-            port: web
+            initialDelaySeconds: 10
-            scheme: HTTP
+            timeoutSeconds: 3
-          initialDelaySeconds: 10
+            periodSeconds: 5
-          timeoutSeconds: 3
+            successThreshold: 1
-          periodSeconds: 5
+            failureThreshold: 3
-          successThreshold: 1
+          readinessProbe:
-          failureThreshold: 3
+            httpGet:
-        readinessProbe:
+              path: /api/v1/health
-          httpGet:
+              port: web
-            path: /api/v1/health
+              scheme: HTTP
-            port: web
+            initialDelaySeconds: 5
-            scheme: HTTP
+            timeoutSeconds: 3
-          initialDelaySeconds: 5
+            periodSeconds: 5
-          timeoutSeconds: 3
+            successThreshold: 1
-          periodSeconds: 5
+            failureThreshold: 3
-          successThreshold: 1
+          resources:
-          failureThreshold: 3
+            requests:
-        resources:
+              memory: "168Mi"
-          requests:
+              cpu: "50m"
-            memory: "168Mi"
+            limits:
-            cpu: "50m"
+              memory: "256Mi"
-          limits:
+              cpu: "500m"
-            memory: "256Mi"
+          securityContext:
-            cpu: "500m"
+            allowPrivilegeEscalation: false
-        securityContext:
+            capabilities:
-          allowPrivilegeEscalation: false
+              drop:
-          capabilities:
+                - ALL
-            drop:
+            readOnlyRootFilesystem: true
-              - ALL
-          readOnlyRootFilesystem: true
       affinity:
         nodeAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -79,14 +78,11 @@ spec:
         - name: nocodb-metadata
           persistentVolumeClaim:
             claimName: nocodb-metadata
-        - name: app-volume
+        - name: tmp
           emptyDir:
-            sizeLimit: 1500Mi
+            sizeLimit: 50Mi
-        - name: app-tmp
-          emptyDir:
-            sizeLimit: 500Mi
       securityContext:
         runAsUser: 1000
         runAsGroup: 1000
         fsGroup: 1000
-        runAsNonRoot: true
+        runAsNonRoot: true

nocodb/resources/dragonfly.yaml

@@ -9,6 +9,8 @@ metadata:
     app.kubernetes.io/part-of: nocodb
 spec:
   replicas: 2
+  nodeSelector:
+    kubernetes.io/arch: arm64
   resources:
     requests:
       cpu: 100m

postgres-operator/kustomization.yaml

@@ -6,13 +6,13 @@ labels:
   pairs:
     app.kubernetes.io/name: pgo
     # The version below should match the version on the PostgresCluster CRD
-    app.kubernetes.io/version: 5.5.0
+    app.kubernetes.io/version: 5.6.0
     postgres-operator.crunchydata.com/control-plane: postgres-operator
 
 images:
 - name: postgres-operator
   newName: registry.developers.crunchydata.com/crunchydata/postgres-operator
-  newTag: ubi8-5.5.0-0
+  newTag: ubi8-5.6.0-0
 
 resources:
   - resources/namespace.yaml

postgres-operator/resources/crd/pgadmins.yaml

@@ -2,11 +2,11 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.8.0
+    controller-gen.kubebuilder.io/version: v0.9.0
   creationTimestamp: null
   labels:
     app.kubernetes.io/name: pgo
-    app.kubernetes.io/version: 5.5.0
+    app.kubernetes.io/version: 5.6.0
   name: pgadmins.postgres-operator.crunchydata.com
 spec:
   group: postgres-operator.crunchydata.com
@@ -20,7 +20,7 @@ spec:
   - name: v1beta1
     schema:
       openAPIV3Schema:
-        description: PGAdmin is the Schema for the pgadmins API
+        description: PGAdmin is the Schema for the PGAdmin API
         properties:
           apiVersion:
             description: 'APIVersion defines the versioned schema of this representation
@@ -860,6 +860,24 @@ spec:
                   to any of these values will be loaded without validation. Be careful,
                   as you may put pgAdmin into an unusable state.
                 properties:
+                  configDatabaseURI:
+                    description: 'A Secret containing the value for the CONFIG_DATABASE_URI
+                      setting. More info: https://www.pgadmin.org/docs/pgadmin4/latest/external_database.html'
+                    properties:
+                      key:
+                        description: The key of the secret to select from.  Must be
+                          a valid secret key.
+                        type: string
+                      name:
+                        description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                        type: string
+                      optional:
+                        description: Specify whether the Secret or its key must be
+                          defined
+                        type: boolean
+                    required:
+                    - key
+                    type: object
                   files:
                     description: Files allows the user to mount projected volumes
                       into the pgAdmin container so that files can be referenced by
@@ -1082,6 +1100,10 @@ spec:
                           type: object
                       type: object
                     type: array
+                  gunicorn:
+                    description: 'Settings for the gunicorn server. More info: https://docs.gunicorn.org/en/latest/settings.html'
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
                   ldapBindPassword:
                     description: 'A Secret containing the value for the LDAP_BIND_PASSWORD
                       setting. More info: https://www.pgadmin.org/docs/pgadmin4/latest/ldap.html'
@@ -1347,6 +1369,10 @@ spec:
                         unique in the pgAdmin's ServerGroups since it becomes the
                         ServerGroup name in pgAdmin.
                       type: string
+                    postgresClusterName:
+                      description: PostgresClusterName selects one cluster to add
+                        to pgAdmin by name.
+                      type: string
                     postgresClusterSelector:
                       description: PostgresClusterSelector selects clusters to dynamically
                         add to pgAdmin by matching labels. An empty selector like
@@ -1395,9 +1421,18 @@ spec:
                       type: object
                   required:
                   - name
-                  - postgresClusterSelector
                   type: object
+                  x-kubernetes-validations:
+                  - message: exactly one of "postgresClusterName" or "postgresClusterSelector"
+                      is required
+                    rule: '[has(self.postgresClusterName),has(self.postgresClusterSelector)].exists_one(x,x)'
                 type: array
+              serviceName:
+                description: ServiceName will be used as the name of a ClusterIP service
+                  pointing to the pgAdmin pod and port. If the service already exists,
+                  PGO will update the service. For more information about services
+                  reference the Kubernetes and CrunchyData documentation. https://kubernetes.io/docs/concepts/services-networking/service/
+                type: string
               tolerations:
                 description: 'Tolerations of the PGAdmin pod. More info: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration'
                 items:
@@ -1438,6 +1473,50 @@ spec:
                       type: string
                   type: object
                 type: array
+              users:
+                description: pgAdmin users that are managed via the PGAdmin spec.
+                  Users can still be added via the pgAdmin GUI, but those users will
+                  not show up here.
+                items:
+                  properties:
+                    passwordRef:
+                      description: A reference to the secret that holds the user's
+                        password.
+                      properties:
+                        key:
+                          description: The key of the secret to select from.  Must
+                            be a valid secret key.
+                          type: string
+                        name:
+                          description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                          type: string
+                        optional:
+                          description: Specify whether the Secret or its key must
+                            be defined
+                          type: boolean
+                      required:
+                      - key
+                      type: object
+                    role:
+                      description: Role determines whether the user has admin privileges
+                        or not. Defaults to User. Valid options are Administrator
+                        and User.
+                      enum:
+                      - Administrator
+                      - User
+                      type: string
+                    username:
+                      description: The username for User in pgAdmin. Must be unique
+                        in the pgAdmin's users list.
+                      type: string
+                  required:
+                  - passwordRef
+                  - username
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - username
+                x-kubernetes-list-type: map
             required:
             - dataVolumeClaimSpec
             type: object
@@ -1445,9 +1524,8 @@ spec:
             description: PGAdminStatus defines the observed state of PGAdmin
             properties:
               conditions:
-                description: 'conditions represent the observations of pgadmin''s
+                description: 'conditions represent the observations of pgAdmin''s
-                  current state. Known .status.conditions.type are: "PersistentVolumeResizing",
+                  current state. Known .status.conditions.type is: "PersistentVolumeResizing"'
-                  "Progressing", "ProxyAvailable"'
                 items:
                   description: "Condition contains details for one aspect of the current
                     state of this API Resource. --- This struct is intended for direct
@@ -1518,6 +1596,14 @@ spec:
                 x-kubernetes-list-map-keys:
                 - type
                 x-kubernetes-list-type: map
+              imageSHA:
+                description: ImageSHA represents the image SHA for the container running
+                  pgAdmin.
+                type: string
+              majorVersion:
+                description: MajorVersion represents the major version of the running
+                  pgAdmin.
+                type: integer
               observedGeneration:
                 description: observedGeneration represents the .metadata.generation
                   on which the status was based.

postgres-operator/resources/crd/pgupgrades.yaml

@@ -2,11 +2,11 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.8.0
+    controller-gen.kubebuilder.io/version: v0.9.0
   creationTimestamp: null
   labels:
     app.kubernetes.io/name: pgo
-    app.kubernetes.io/version: 5.5.0
+    app.kubernetes.io/version: 5.6.0
   name: pgupgrades.postgres-operator.crunchydata.com
 spec:
   group: postgres-operator.crunchydata.com

postgres-operator/resources/crd/postgresclusters.yaml

@@ -2,11 +2,11 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.8.0
+    controller-gen.kubebuilder.io/version: v0.9.0
   creationTimestamp: null
   labels:
     app.kubernetes.io/name: pgo
-    app.kubernetes.io/version: 5.5.0
+    app.kubernetes.io/version: 5.6.0
   name: postgresclusters.postgres-operator.crunchydata.com
 spec:
   group: postgres-operator.crunchydata.com
@@ -2695,7 +2695,7 @@ spec:
                               - bucket
                               type: object
                             name:
-                              description: The name of the the repository
+                              description: The name of the repository
                               pattern: ^repo[1-4]
                               type: string
                             s3:
@@ -4438,10 +4438,10 @@ spec:
                 properties:
                   pgbackrest:
                     description: 'Defines a pgBackRest cloud-based data source that
-                      can be used to pre-populate the the PostgreSQL data directory
+                      can be used to pre-populate the PostgreSQL data directory for
-                      for a new PostgreSQL cluster using a pgBackRest restore. The
+                      a new PostgreSQL cluster using a pgBackRest restore. The PGBackRest
-                      PGBackRest field is incompatible with the PostgresCluster field:
+                      field is incompatible with the PostgresCluster field: only one
-                      only one data source can be used for pre-populating a new PostgreSQL
+                      data source can be used for pre-populating a new PostgreSQL
                       cluster'
                     properties:
                       affinity:
@@ -5615,7 +5615,7 @@ spec:
                             - bucket
                             type: object
                           name:
-                            description: The name of the the repository
+                            description: The name of the repository
                             pattern: ^repo[1-4]
                             type: string
                           s3:
@@ -10396,7 +10396,7 @@ spec:
                     description: 'Patroni dynamic configuration settings. Changes
                       to this value will be automatically reloaded without validation.
                       Changes to certain PostgreSQL parameters cause PostgreSQL to
-                      restart. More info: https://patroni.readthedocs.io/en/latest/SETTINGS.html'
+                      restart. More info: https://patroni.readthedocs.io/en/latest/dynamic_configuration.html'
                     type: object
                     x-kubernetes-preserve-unknown-fields: true
                   leaderLeaseDurationSeconds:
@@ -13060,6 +13060,18 @@ spec:
                       service:
                         description: Specification of the service that exposes PgBouncer.
                         properties:
+                          externalTrafficPolicy:
+                            description: 'More info: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies'
+                            enum:
+                            - Cluster
+                            - Local
+                            type: string
+                          internalTrafficPolicy:
+                            description: 'More info: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies'
+                            enum:
+                            - Cluster
+                            - Local
+                            type: string
                           metadata:
                             description: Metadata contains metadata for custom resources
                             properties:
@@ -13319,10 +13331,66 @@ spec:
                 required:
                 - pgBouncer
                 type: object
+              replicaService:
+                description: Specification of the service that exposes PostgreSQL
+                  replica instances
+                properties:
+                  externalTrafficPolicy:
+                    description: 'More info: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies'
+                    enum:
+                    - Cluster
+                    - Local
+                    type: string
+                  internalTrafficPolicy:
+                    description: 'More info: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies'
+                    enum:
+                    - Cluster
+                    - Local
+                    type: string
+                  metadata:
+                    description: Metadata contains metadata for custom resources
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      labels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                    type: object
+                  nodePort:
+                    description: The port on which this service is exposed when type
+                      is NodePort or LoadBalancer. Value must be in-range and not
+                      in use or the operation will fail. If unspecified, a port will
+                      be allocated if this Service requires one. - https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
+                    format: int32
+                    type: integer
+                  type:
+                    default: ClusterIP
+                    description: 'More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types'
+                    enum:
+                    - ClusterIP
+                    - NodePort
+                    - LoadBalancer
+                    type: string
+                type: object
               service:
                 description: Specification of the service that exposes the PostgreSQL
                   primary instance.
                 properties:
+                  externalTrafficPolicy:
+                    description: 'More info: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies'
+                    enum:
+                    - Cluster
+                    - Local
+                    type: string
+                  internalTrafficPolicy:
+                    description: 'More info: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies'
+                    enum:
+                    - Cluster
+                    - Local
+                    type: string
                   metadata:
                     description: Metadata contains metadata for custom resources
                     properties:
@@ -14793,6 +14861,18 @@ spec:
                       service:
                         description: Specification of the service that exposes pgAdmin.
                         properties:
+                          externalTrafficPolicy:
+                            description: 'More info: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies'
+                            enum:
+                            - Cluster
+                            - Local
+                            type: string
+                          internalTrafficPolicy:
+                            description: 'More info: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies'
+                            enum:
+                            - Cluster
+                            - Local
+                            type: string
                           metadata:
                             description: Metadata contains metadata for custom resources
                             properties:
@@ -15048,8 +15128,14 @@ spec:
                     options:
                       description: 'ALTER ROLE options except for PASSWORD. This field
                         is ignored for the "postgres" user. More info: https://www.postgresql.org/docs/current/role-attributes.html'
+                      maxLength: 200
                       pattern: ^[^;]*$
                       type: string
+                      x-kubernetes-validations:
+                      - message: cannot assign password
+                        rule: '!self.matches("(?i:PASSWORD)")'
+                      - message: cannot contain comments
+                        rule: '!self.matches("(?:--|/[*]|[*]/)")'
                     password:
                       description: Properties of the password generated for this user.
                       properties:
@@ -15070,6 +15156,7 @@ spec:
                   required:
                   - name
                   type: object
+                maxItems: 64
                 type: array
                 x-kubernetes-list-map-keys:
                 - name
@@ -15157,6 +15244,11 @@ spec:
                 description: Current state of PostgreSQL instances.
                 items:
                   properties:
+                    desiredPGDataVolume:
+                      additionalProperties:
+                        type: string
+                      description: Desired Size of the pgData volume
+                      type: object
                     name:
                       type: string
                     readyReplicas:
@@ -15291,7 +15383,7 @@ spec:
                           type: boolean
                         repoOptionsHash:
                           description: A hash of the required fields in the spec for
-                            defining an Azure, GCS or S3 repository, Utilizd to detect
+                            defining an Azure, GCS or S3 repository, Utilized to detect
                             changes to these fields and then execute pgBackRest stanza-create
                             commands accordingly.
                           type: string
@@ -15425,8 +15517,6 @@ spec:
                     type: object
                 type: object
               registrationRequired:
-                description: Version information for installations with a registration
-                  requirement.
                 properties:
                   pgoVersion:
                     type: string
@@ -15439,8 +15529,6 @@ spec:
                 description: The instance set associated with the startupInstance
                 type: string
               tokenRequired:
-                description: Signals the need for a token to be applied when registration
-                  is required.
                 type: string
               userInterface:
                 description: Current state of the PostgreSQL user interface.

s3-csi/kustomization.yaml

@@ -13,7 +13,7 @@ images:
     newTag: v2.10.1
   - name: provisioner
     newName: registry.k8s.io/sig-storage/csi-provisioner
-    newTag: v5.0.1
+    newTag: v5.0.2
   - name: csi
     newName: code.icb4dc0.de/infrastructure/csi-s3
     newTag: 0.38.3

snips/kustomization.yaml

@@ -6,7 +6,7 @@ namespace: snips
 images:
   - name: snips
     newName: ghcr.io/robherley/snips.sh
-    newTag: v0.3.2
+    newTag: v0.4.0
   - name: litestream
     newName: code.icb4dc0.de/infrastructure/litestream
     newTag: "0.3.14-rc1"

umami/kustomization.yaml

@@ -6,7 +6,7 @@ namespace: umami
 images:
   - name: umami
     newName: ghcr.io/umami-software/umami
-    newTag: postgresql-v2.11.3
+    newTag: postgresql-v2.12.1
 
 labels:
 - includeSelectors: true

vaultwarden/kustomization.yaml

@@ -12,7 +12,7 @@ labels:
 images:
   - name: vaultwarden
     newName: ghcr.io/dani-garcia/vaultwarden
-    newTag: "1.30.5-alpine"
+    newTag: "1.31.0-alpine"
 
 resources:
   - "resources/namespace.yaml"

vikunja/resources/api/dragonfly.yaml

@@ -9,6 +9,8 @@ metadata:
     app.kubernetes.io/part-of: vikunja
 spec:
   replicas: 2
+  nodeSelector:
+    kubernetes.io/arch: arm64
   resources:
     requests:
       cpu: 50m