fix(reloader): restart audiobookshelf and immich-server on ConfigMap change

Both consume their ConfigMap with envFrom, which Kubernetes does not watch: a changed value applies in git and in the cluster while the running container keeps the environment it started with. Paperless hit exactly this in #739 and got the annotation in #741; these two were the remaining envFrom consumers without one. ftp-scanner, the third Deployment named in the issue, needs nothing: its ConfigMap comes from a configMapGenerator that deliberately keeps the content-hash suffix, so any change renames the ConfigMap, mutates the pod template and rolls the pod on its own. Reloader already watches all namespaces (kubernetes/infrastructure/reloader). Fixes #742 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Merge pull request 'fix(netbird-proxy-services): pin the digest the master build produced' (#818 ) from netbird-proxy-protocol-digest into master
2026-09-08 06:46:12 +02:00 · 2026-09-07 11:52:17 +00:00 · 2026-09-07 13:47:22 +02:00 · 2026-09-07 11:34:52 +00:00 · 2026-09-07 11:34:43 +00:00
3 changed files with 10 additions and 2 deletions
@@ -21,6 +21,9 @@ metadata:
  namespace: audiobookshelf
  labels:
    app.kubernetes.io/name: audiobookshelf
+  annotations:
+    # envFrom does not restart the pod when the ConfigMap changes; Reloader does.
+    configmap.reloader.stakater.com/reload: audiobookshelf-config
 spec:
  replicas: 1
  strategy:
@@ -35,6 +35,9 @@ metadata:
  namespace: immich
  labels:
    app.kubernetes.io/name: immich-server
+  annotations:
+    # envFrom does not restart the pod when the ConfigMap changes; Reloader does.
+    configmap.reloader.stakater.com/reload: immich-config
 spec:
  # Scaled to 0 alongside immich-machine-learning during single-node
  # maintenance; see the note there. The CNPG Postgres cluster stays running,
@@ -77,8 +77,10 @@ spec:
      containers:
        - name: controller
          # Pinned by digest: the date tag is rebuilt on every push of the
-          # image directory, so the tag alone cannot express a new build.
-          image: gitea.renner.uno/gitea_admin/netbird-proxy-services:2026-09-07@sha256:0d266b0288aec692c698ff5c05f76c826e247bfef365e0306a0b9a6541ebf180
+          # image directory (branch and master alike) and the registry keeps
+          # only the newest manifest per tag, so the digest must come from
+          # the MASTER build of the code change.
+          image: gitea.renner.uno/gitea_admin/netbird-proxy-services:2026-09-07@sha256:caffa308d802c6fcc6aea919ac94657c08b993651baa6b8d18de395bcc40523e
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
Author	SHA1	Message	Date
claude-botandClaude Fable 5.1	6008d59c9f	fix(reloader): restart audiobookshelf and immich-server on ConfigMap change ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details Both consume their ConfigMap with envFrom, which Kubernetes does not watch: a changed value applies in git and in the cluster while the running container keeps the environment it started with. Paperless hit exactly this in #739 and got the annotation in #741; these two were the remaining envFrom consumers without one. ftp-scanner, the third Deployment named in the issue, needs nothing: its ConfigMap comes from a configMapGenerator that deliberately keeps the content-hash suffix, so any change renames the ConfigMap, mutates the pod template and rolls the pod on its own. Reloader already watches all namespaces (kubernetes/infrastructure/reloader). Fixes #742 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-08 06:46:12 +02:00
k.renner	5aa6c0609d	Merge pull request 'fix(netbird-proxy-services): pin the digest the master build produced' (#818 ) from netbird-proxy-protocol-digest into master ci/woodpecker/cron/e2e Pipeline failed Details ci/woodpecker/cron/security-scan Pipeline was successful Details ci/woodpecker/cron/issue-fix Pipeline was successful Details ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#818	2026-09-07 11:52:17 +00:00
claude-botandClaude Fable 5.1	0ebe113abb	fix(netbird-proxy-services): pin the digest the master build produced ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details #817 pinned the digest from the branch build (pipeline 8452). Merging #816 rebuilt the same date tag on master (pipeline 8457), Gitea kept only the new manifest, and the pod has been in ImagePullBackOff since: "failed to resolve reference ...@sha256:0d266b02...". With the Recreate strategy no controller is running, so the services are unchanged. The kaniko step of the master build pushed sha256:caffa308...; that is the digest to pin. Comment states the rule. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-07 13:47:22 +02:00
k.renner	1723f73b5d	Merge pull request 'feat(netbird-proxy-services): roll the PROXY-protocol build (2/2)' (#817 ) from netbird-proxy-protocol-deploy into master ci/woodpecker/cron/issue-fix Pipeline was successful Details ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#817	2026-09-07 11:34:52 +00:00
k.renner	8d8df3b635	Merge pull request 'feat(netbird): carry the WAN client address through the passthrough edge (1/2)' (#816 ) from netbird-proxy-protocol into master ci/woodpecker/push/build-ci-images Pipeline was successful Details Reviewed-on: k.renner/homelab#816	2026-09-07 11:34:43 +00:00