firefly-iii: Update to 6.4.2

Sometimes, Grafana gets pretty slow, especially when it's running on one
of the Raspberry Pi nodes.  When this happens, the health check may take
longer than the default timeout of 1 second to respond.  This then marks
the pod as unhealthy, even though it's still working.

authelia/kustomization.yaml

@@ -58,4 +58,4 @@ patches:
               name: dch-root-ca
 images:
 - name: ghcr.io/authelia/authelia
-  newTag: 4.39.9
+  newTag: 4.39.12

grafana/grafana.yaml

@@ -60,6 +60,7 @@ spec:
             port: http
             path: /api/health
           periodSeconds: 60
+          timeoutSeconds: 5
         startupProbe:
           <<: *probe
           periodSeconds: 1

k8s-reboot-coordinator/jenkins.yaml

@@ -0,0 +1,36 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: jenkins.k8s-reboot-coordinator
+  labels:
+    app.kubernetes.io/name: jenkins.k8s-reboot-coordinator
+    app.kubernetes.io/component: k8s-reboot-coordinator
+    app.kubernetes.io/part-of: k8s-reboot-coordinator
+rules:
+- apiGroups:
+  - apps
+  resources:
+  - daemonsets
+  resourceNames:
+  - k8s-reboot-coordinator
+  verbs:
+  - get
+  - patch
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: jenkins.k8s-reboot-coordinator
+  labels:
+    app.kubernetes.io/name: jenkins.k8s-reboot-coordinator
+    app.kubernetes.io/component: k8s-reboot-coordinator
+    app.kubernetes.io/part-of: k8s-reboot-coordinator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: jenkins.k8s-reboot-coordinator
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: jenkins-jobs

k8s-reboot-coordinator/kustomization.yaml

@@ -0,0 +1,37 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: kube-system
+
+labels:
+- pairs:
+    app.kubernetes.io/instance: k8s-reboot-coordinator
+  includeSelectors: true
+
+resources:
+- https://git.pyrocufflink.net/dustin/k8s-reboot-coordinator//kubernetes?ref=master
+- service.yaml
+- jenkins.yaml
+
+images:
+- name: k8s-reboot-coordinator
+  newName: git.pyrocufflink.net/packages/k8s-reboot-coordinator
+  newTag: latest
+
+patches:
+- patch: |-
+    apiVersion: apps/v1
+    kind: DaemonSet
+    metadata:
+      name: k8s-reboot-coordinator
+    spec:
+      template:
+        spec:
+          containers:
+          - name: k8s-reboot-coordinator
+            imagePullPolicy: Always
+            env:
+            - name: RUST_LOG
+              value: k8s_reboot_coordinator=debug,info
+          imagePullSecrets:
+          - name: imagepull-gitea

k8s-reboot-coordinator/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: &name k8s-reboot-coordinator
+  labels: &labels
+    app.kubernetes.io/name: *name
+    app.kubernetes.io/component: *name
+    app.kubernetes.io/part-of: *name
+spec:
+  selector: *labels
+  ports:
+  - port: 8000
+    targetPort: http
+    name: http

paperless-ngx/kustomization.yaml

@@ -47,6 +47,6 @@ images:
 - name: ghcr.io/paperless-ngx/paperless-ngx
   newTag: 2.18.4
 - name: docker.io/gotenberg/gotenberg
-  newTag: 8.23.0
+  newTag: 8.24.0
 - name: docker.io/apache/tika
-  newTag: 3.2.2.0
+  newTag: 3.2.3.0

policy/README.md

@@ -0,0 +1,30 @@
+# Cluster Policies
+
+## Validating Admission Policy
+
+To enable (prior to Kubernetes v1.30):
+
+1. Add the following to `apiServer.extraArgs` in the `ClusterConfiguration` key
+   of the `kubeadm-config` ConfigMap:
+
+   ```yaml
+   feature-gates: ValidatingAdmissionPolicy=true
+   runtime-config: admissionregistration.k8s.io/v1beta1=true
+   ```
+2. Redeploy the API servers using `kubeadm`:
+
+   ```sh
+   doas kubeadm upgrade apply v1.29.15 --yes
+   ```
+
+
+### disallow-hostnetwork
+
+This policy prevents pods from running in the host's network namespace. This is
+especially important because most nodes are connected to the storage network
+VLAN, so allowing pods to use the host network namespace would give them access
+to the iSCSI LUNs and NFS shares on the NAS.
+
+If a trusted pod needs to run in the host's network namespace, its Kubernetes
+namespace can be listed in the exclusion list of the
+`disallow-hostnetwork-binding` policy binding resource.

policy/disallow-hostnetwork.yaml

@@ -0,0 +1,43 @@
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: disallow-hostnetwork
+spec:
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+      - ''
+      apiVersions:
+      - v1
+      operations:
+      - CREATE
+      - UPDATE
+      resources:
+      - pods
+  validations:
+  - expression: >-
+      !has(object.spec.hostNetwork) || !object.spec.hostNetwork
+    message: >-
+      Pods must not use hostNetwork: true
+
+---
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: disallow-hostnetwork-binding
+spec:
+  policyName: disallow-hostnetwork
+  validationActions:
+  - Deny
+  matchResources:
+    namespaceSelector:
+      matchExpressions:
+      - key: kubernetes.io/metadata.name
+        operator: NotIn
+        values:
+        - calico-system
+        - democratic-csi
+        - keepalived
+        - kube-system
+        - music-assistant
+        - tigera-operator

policy/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- disallow-hostnetwork.yaml