fix(reloader): restart audiobookshelf and immich-server on ConfigMap change

Both consume their ConfigMap with envFrom, which Kubernetes does not watch: a changed value applies in git and in the cluster while the running container keeps the environment it started with. Paperless hit exactly this in #739 and got the annotation in #741; these two were the remaining envFrom consumers without one. ftp-scanner, the third Deployment named in the issue, needs nothing: its ConfigMap comes from a configMapGenerator that deliberately keeps the content-hash suffix, so any change renames the ConfigMap, mutates the pod template and rolls the pod on its own. Reloader already watches all namespaces (kubernetes/infrastructure/reloader). Fixes #742 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Merge pull request 'fix(netbird-proxy-services): pin the digest the master build produced' (#818 ) from netbird-proxy-protocol-digest into master
2026-09-08 06:46:12 +02:00 · 2026-09-07 11:52:17 +00:00 · 2026-09-07 13:47:22 +02:00 · 2026-09-07 11:34:52 +00:00 · 2026-09-07 11:34:43 +00:00 · 2026-09-07 13:32:06 +02:00
3 changed files with 11 additions and 1 deletions
@@ -21,6 +21,9 @@ metadata:
  namespace: audiobookshelf
  labels:
    app.kubernetes.io/name: audiobookshelf
+  annotations:
+    # envFrom does not restart the pod when the ConfigMap changes; Reloader does.
+    configmap.reloader.stakater.com/reload: audiobookshelf-config
 spec:
  replicas: 1
  strategy:
@@ -35,6 +35,9 @@ metadata:
  namespace: immich
  labels:
    app.kubernetes.io/name: immich-server
+  annotations:
+    # envFrom does not restart the pod when the ConfigMap changes; Reloader does.
+    configmap.reloader.stakater.com/reload: immich-config
 spec:
  # Scaled to 0 alongside immich-machine-learning during single-node
  # maintenance; see the note there. The CNPG Postgres cluster stays running,
@@ -76,7 +76,11 @@ spec:
          type: RuntimeDefault
      containers:
        - name: controller
-          image: gitea.renner.uno/gitea_admin/netbird-proxy-services:2026-09-07
+          # Pinned by digest: the date tag is rebuilt on every push of the
+          # image directory (branch and master alike) and the registry keeps
+          # only the newest manifest per tag, so the digest must come from
+          # the MASTER build of the code change.
+          image: gitea.renner.uno/gitea_admin/netbird-proxy-services:2026-09-07@sha256:caffa308d802c6fcc6aea919ac94657c08b993651baa6b8d18de395bcc40523e
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
Author	SHA1	Message	Date
claude-botandClaude Fable 5.1	6008d59c9f	fix(reloader): restart audiobookshelf and immich-server on ConfigMap change ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details Both consume their ConfigMap with envFrom, which Kubernetes does not watch: a changed value applies in git and in the cluster while the running container keeps the environment it started with. Paperless hit exactly this in #739 and got the annotation in #741; these two were the remaining envFrom consumers without one. ftp-scanner, the third Deployment named in the issue, needs nothing: its ConfigMap comes from a configMapGenerator that deliberately keeps the content-hash suffix, so any change renames the ConfigMap, mutates the pod template and rolls the pod on its own. Reloader already watches all namespaces (kubernetes/infrastructure/reloader). Fixes #742 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-08 06:46:12 +02:00
k.renner	5aa6c0609d	Merge pull request 'fix(netbird-proxy-services): pin the digest the master build produced' (#818 ) from netbird-proxy-protocol-digest into master ci/woodpecker/cron/e2e Pipeline failed Details ci/woodpecker/cron/security-scan Pipeline was successful Details ci/woodpecker/cron/issue-fix Pipeline was successful Details ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#818	2026-09-07 11:52:17 +00:00
claude-botandClaude Fable 5.1	0ebe113abb	fix(netbird-proxy-services): pin the digest the master build produced ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details #817 pinned the digest from the branch build (pipeline 8452). Merging #816 rebuilt the same date tag on master (pipeline 8457), Gitea kept only the new manifest, and the pod has been in ImagePullBackOff since: "failed to resolve reference ...@sha256:0d266b02...". With the Recreate strategy no controller is running, so the services are unchanged. The kaniko step of the master build pushed sha256:caffa308...; that is the digest to pin. Comment states the rule. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-07 13:47:22 +02:00
k.renner	1723f73b5d	Merge pull request 'feat(netbird-proxy-services): roll the PROXY-protocol build (2/2)' (#817 ) from netbird-proxy-protocol-deploy into master ci/woodpecker/cron/issue-fix Pipeline was successful Details ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#817	2026-09-07 11:34:52 +00:00
k.renner	8d8df3b635	Merge pull request 'feat(netbird): carry the WAN client address through the passthrough edge (1/2)' (#816 ) from netbird-proxy-protocol into master ci/woodpecker/push/build-ci-images Pipeline was successful Details Reviewed-on: k.renner/homelab#816	2026-09-07 11:34:43 +00:00
claude-botandClaude Fable 5.1	29c91769a7	feat(netbird-proxy-services): roll the PROXY-protocol build (2/2) ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details Pins the controller image by digest. The registry tag is the build date and pipeline 8452 rebuilt today's tag in place, so the tag alone cannot carry a new build to the cluster; the digest can. Merge only after the Traefik change from 1/2 has reconciled: from this build on every service target sends a PROXY protocol v2 header, and Traefik drops such connections unless websecure trusts the pod CIDRs. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-07 13:32:06 +02:00