feat(images): one date tag per in-house konairius build, rolled out by Flux #1510

2026-10-28T06:42:48Z

claude-bot commented

2026-10-28 06:42:48 +00:00

Gitea's konairius package cleanup rule keeps the most recent version and counts every tag as a version. Builds that push several tags (build.<ts>, sha, main, latest) keep only the last-pushed one, so the tag a workload runs gets deleted. vsftpd kept only main, and ImagePolicy vsftpd fails with version list argument cannot be empty. ical-proxy's pinned main-926ead0 is gone too.

Every konairius image is now pushed with exactly one tag, YYYY-MM-DD-HHMM (UTC), the scheme review-bot and the gitea_admin images use. Every consumer follows that tag through an ImagePolicy instead of a hand-written pin.

Pipelines in this repo

hermes-image.yml: date tag only, no :latest.
build-ci-images.yml: alpine-jq, cni-plugins and alpine-openssl are tagged YYYY-MM-DD-HHMM. The konairius/ and ghcr copies drop :latest; the gitea_admin/ copies are unchanged.

Flux

The hermes, wiki, shelly-manager and vsftpd policies move to the review-bot filter ^\d{4}-\d{2}-\d{2}(-\d{4})?$, sorted alphabetically.
New policies and markers:
- ical-proxy
- mqtt-account-controller
- authentik-samba-bridge-server (the HelmRelease tag)
- authentik-samba-bridge-ldap-outpost
- alpine-jq, alpine-openssl, cni-plugins: their existing YYYY-MM-DD tags match the filter.
The outpost image moves out of the blueprint string, which Flux setters can't patch. It now lives in global.env SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE, and the blueprint reads it with !Env, the same pattern as LDAP_OUTPOST_TLS_* and AUTHENTIK_GATE_SYNC_TOKEN.
renovate.json: the newly Flux-tracked images join the disabled list.
README and the Hermes homelab-gitea-pr guide document the scheme: one date tag, no hand-written pins.

Merge order

Merge first: konairius/vsftpd#4, konairius/ical-proxy#20, konairius/shelly-manager#119, konairius/Wiki#24, konairius/mqtt-account-controller#20, konairius/authentik-samba-bridge#9. Each push builds that image's first date tag.
Then merge this PR. The policies need those date tags to resolve. Hermes and the three utility images rebuild from this PR's own push (their pipeline files change).

After this merges, image automation rewrites the tags in all of these:

hermes
wiki
shelly-manager
ftp-scanner
ical-proxy
mqtt-account-controller
authentik server, worker and LDAP outpost
zigbee2mqtt and trmnl init containers
paperless init container
multus cni-plugins DaemonSet

Each one rolls once.

🤖 Generated with Claude Code

Fixes #1509. Gitea's konairius package cleanup rule keeps the most recent version and counts every tag as a version. Builds that push several tags (`build.<ts>`, sha, `main`, `latest`) keep only the last-pushed one, so the tag a workload runs gets deleted. vsftpd kept only `main`, and ImagePolicy vsftpd fails with `version list argument cannot be empty`. ical-proxy's pinned `main-926ead0` is gone too. Every konairius image is now pushed with exactly one tag, `YYYY-MM-DD-HHMM` (UTC), the scheme review-bot and the gitea_admin images use. Every consumer follows that tag through an ImagePolicy instead of a hand-written pin. **Pipelines in this repo** - `hermes-image.yml`: date tag only, no `:latest`. - `build-ci-images.yml`: alpine-jq, cni-plugins and alpine-openssl are tagged `YYYY-MM-DD-HHMM`. The konairius/ and ghcr copies drop `:latest`; the gitea_admin/ copies are unchanged. **Flux** - The hermes, wiki, shelly-manager and vsftpd policies move to the review-bot filter `^\d{4}-\d{2}-\d{2}(-\d{4})?$`, sorted alphabetically. - New policies and markers: - ical-proxy - mqtt-account-controller - authentik-samba-bridge-server (the HelmRelease `tag`) - authentik-samba-bridge-ldap-outpost - alpine-jq, alpine-openssl, cni-plugins: their existing `YYYY-MM-DD` tags match the filter. - The outpost image moves out of the blueprint string, which Flux setters can't patch. It now lives in `global.env` `SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE`, and the blueprint reads it with `!Env`, the same pattern as `LDAP_OUTPOST_TLS_*` and `AUTHENTIK_GATE_SYNC_TOKEN`. - `renovate.json`: the newly Flux-tracked images join the disabled list. - README and the Hermes homelab-gitea-pr guide document the scheme: one date tag, no hand-written pins. **Merge order** 1. Merge first: konairius/vsftpd#4, konairius/ical-proxy#20, konairius/shelly-manager#119, konairius/Wiki#24, konairius/mqtt-account-controller#20, konairius/authentik-samba-bridge#9. Each push builds that image's first date tag. 2. Then merge this PR. The policies need those date tags to resolve. Hermes and the three utility images rebuild from this PR's own push (their pipeline files change). After this merges, image automation rewrites the tags in all of these: - hermes - wiki - shelly-manager - ftp-scanner - ical-proxy - mqtt-account-controller - authentik server, worker and LDAP outpost - zigbee2mqtt and trmnl init containers - paperless init container - multus cni-plugins DaemonSet Each one rolls once. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-10-28 06:42:48 +00:00

feat(images): one date tag per in-house konairius build, rolled out by Flux

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

20be3ada61

Gitea's konairius package cleanup rule keeps the most recent version and
counts every tag as a version. Builds that push several tags (build.<ts>,
sha, main, latest) keep only the last-pushed one, so the tag a workload
runs gets deleted: vsftpd kept only `main` and ImagePolicy vsftpd fails
with "version list argument cannot be empty" (#1509); ical-proxy's pinned
main-926ead0 is gone too.

Every konairius image is now pushed with exactly one tag, YYYY-MM-DD-HHMM
(UTC), the scheme review-bot and the gitea_admin images use, and every
consumer follows it through an ImagePolicy instead of a hand-written pin:

- hermes-image.yml: date tag only, no :latest.
- build-ci-images.yml: alpine-jq, cni-plugins, alpine-openssl tag
  YYYY-MM-DD-HHMM; the konairius/ and ghcr copies drop :latest.
  gitea_admin/ copies are unchanged.
- ImagePolicies for hermes, wiki, shelly-manager, vsftpd switch to the
  date filter (alphabetical, accepts YYYY-MM-DD for the older utility
  builds). New policies and markers: ical-proxy, mqtt-account-controller,
  authentik-samba-bridge-server (HelmRelease tag), the samba-bridge LDAP
  outpost, alpine-jq, alpine-openssl, cni-plugins.
- The outpost image moves out of the blueprint string, which Flux setters
  cannot patch, into global.env SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE, read by
  the blueprint via !Env (same pattern as LDAP_OUTPOST_TLS_* and
  AUTHENTIK_GATE_SYNC_TOKEN).
- renovate.json: the new Flux-tracked images join the disabled list.
- Hermes homelab-gitea-pr guide: date tag, one tag, no hand pins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k.renner merged commit 3248c01d33 into main

2026-10-28 07:03:58 +00:00

claude-bot referenced this issue from a commit

2026-10-28 07:16:12 +00:00

fix(authentik): LDAP outpost image back to a literal in the blueprint

claude-bot referenced this pull request

2026-10-28 07:16:18 +00:00

fix(authentik): LDAP outpost image back to a literal in the blueprint #1511

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1510