firefly-iii: Update to 6.4.2

authelia/kustomization.yaml

@@ -58,4 +58,4 @@ patches:
               name: dch-root-ca
 images:
 - name: ghcr.io/authelia/authelia
-  newTag: 4.39.12
+  newTag: 4.39.9

grafana/grafana.yaml

@@ -60,7 +60,6 @@ spec:
             port: http
             path: /api/health
           periodSeconds: 60
-          timeoutSeconds: 5
         startupProbe:
           <<: *probe
           periodSeconds: 1

k8s-reboot-coordinator/jenkins.yaml

@@ -1,36 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: jenkins.k8s-reboot-coordinator
-  labels:
-    app.kubernetes.io/name: jenkins.k8s-reboot-coordinator
-    app.kubernetes.io/component: k8s-reboot-coordinator
-    app.kubernetes.io/part-of: k8s-reboot-coordinator
-rules:
-- apiGroups:
-  - apps
-  resources:
-  - daemonsets
-  resourceNames:
-  - k8s-reboot-coordinator
-  verbs:
-  - get
-  - patch
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: jenkins.k8s-reboot-coordinator
-  labels:
-    app.kubernetes.io/name: jenkins.k8s-reboot-coordinator
-    app.kubernetes.io/component: k8s-reboot-coordinator
-    app.kubernetes.io/part-of: k8s-reboot-coordinator
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: jenkins.k8s-reboot-coordinator
-subjects:
-- kind: ServiceAccount
-  name: default
-  namespace: jenkins-jobs

k8s-reboot-coordinator/kustomization.yaml

@@ -1,37 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: kube-system
-
-labels:
-- pairs:
-    app.kubernetes.io/instance: k8s-reboot-coordinator
-  includeSelectors: true
-
-resources:
-- https://git.pyrocufflink.net/dustin/k8s-reboot-coordinator//kubernetes?ref=master
-- service.yaml
-- jenkins.yaml
-
-images:
-- name: k8s-reboot-coordinator
-  newName: git.pyrocufflink.net/packages/k8s-reboot-coordinator
-  newTag: latest
-
-patches:
-- patch: |-
-    apiVersion: apps/v1
-    kind: DaemonSet
-    metadata:
-      name: k8s-reboot-coordinator
-    spec:
-      template:
-        spec:
-          containers:
-          - name: k8s-reboot-coordinator
-            imagePullPolicy: Always
-            env:
-            - name: RUST_LOG
-              value: k8s_reboot_coordinator=debug,info
-          imagePullSecrets:
-          - name: imagepull-gitea

k8s-reboot-coordinator/service.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: &name k8s-reboot-coordinator
-  labels: &labels
-    app.kubernetes.io/name: *name
-    app.kubernetes.io/component: *name
-    app.kubernetes.io/part-of: *name
-spec:
-  selector: *labels
-  ports:
-  - port: 8000
-    targetPort: http
-    name: http

paperless-ngx/kustomization.yaml

@@ -47,6 +47,6 @@ images:
 - name: ghcr.io/paperless-ngx/paperless-ngx
   newTag: 2.18.4
 - name: docker.io/gotenberg/gotenberg
-  newTag: 8.24.0
+  newTag: 8.23.0
 - name: docker.io/apache/tika
-  newTag: 3.2.3.0
+  newTag: 3.2.2.0

policy/README.md

@@ -1,30 +0,0 @@
-# Cluster Policies
-
-## Validating Admission Policy
-
-To enable (prior to Kubernetes v1.30):
-
-1. Add the following to `apiServer.extraArgs` in the `ClusterConfiguration` key
-   of the `kubeadm-config` ConfigMap:
-
-   ```yaml
-   feature-gates: ValidatingAdmissionPolicy=true
-   runtime-config: admissionregistration.k8s.io/v1beta1=true
-   ```
-2. Redeploy the API servers using `kubeadm`:
-
-   ```sh
-   doas kubeadm upgrade apply v1.29.15 --yes
-   ```
-
-
-### disallow-hostnetwork
-
-This policy prevents pods from running in the host's network namespace. This is
-especially important because most nodes are connected to the storage network
-VLAN, so allowing pods to use the host network namespace would give them access
-to the iSCSI LUNs and NFS shares on the NAS.
-
-If a trusted pod needs to run in the host's network namespace, its Kubernetes
-namespace can be listed in the exclusion list of the
-`disallow-hostnetwork-binding` policy binding resource.

policy/disallow-hostnetwork.yaml

@@ -1,43 +0,0 @@
-apiVersion: admissionregistration.k8s.io/v1beta1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: disallow-hostnetwork
-spec:
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-      - ''
-      apiVersions:
-      - v1
-      operations:
-      - CREATE
-      - UPDATE
-      resources:
-      - pods
-  validations:
-  - expression: >-
-      !has(object.spec.hostNetwork) || !object.spec.hostNetwork
-    message: >-
-      Pods must not use hostNetwork: true
-
----
-apiVersion: admissionregistration.k8s.io/v1beta1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: disallow-hostnetwork-binding
-spec:
-  policyName: disallow-hostnetwork
-  validationActions:
-  - Deny
-  matchResources:
-    namespaceSelector:
-      matchExpressions:
-      - key: kubernetes.io/metadata.name
-        operator: NotIn
-        values:
-        - calico-system
-        - democratic-csi
-        - keepalived
-        - kube-system
-        - music-assistant
-        - tigera-operator

policy/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-- disallow-hostnetwork.yaml