From 20be3ada614f308cab2d38ad9e6a748edc59d17d Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Wed, 28 Oct 2026 07:37:21 +0100 Subject: [PATCH] feat(images): one date tag per in-house konairius build, rolled out by Flux Gitea's konairius package cleanup rule keeps the most recent version and counts every tag as a version. Builds that push several tags (build., sha, main, latest) keep only the last-pushed one, so the tag a workload runs gets deleted: vsftpd kept only `main` and ImagePolicy vsftpd fails with "version list argument cannot be empty" (#1509); ical-proxy's pinned main-926ead0 is gone too. Every konairius image is now pushed with exactly one tag, YYYY-MM-DD-HHMM (UTC), the scheme review-bot and the gitea_admin images use, and every consumer follows it through an ImagePolicy instead of a hand-written pin: - hermes-image.yml: date tag only, no :latest. - build-ci-images.yml: alpine-jq, cni-plugins, alpine-openssl tag YYYY-MM-DD-HHMM; the konairius/ and ghcr copies drop :latest. gitea_admin/ copies are unchanged. - ImagePolicies for hermes, wiki, shelly-manager, vsftpd switch to the date filter (alphabetical, accepts YYYY-MM-DD for the older utility builds). New policies and markers: ical-proxy, mqtt-account-controller, authentik-samba-bridge-server (HelmRelease tag), the samba-bridge LDAP outpost, alpine-jq, alpine-openssl, cni-plugins. - The outpost image moves out of the blueprint string, which Flux setters cannot patch, into global.env SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE, read by the blueprint via !Env (same pattern as LDAP_OUTPOST_TLS_* and AUTHENTIK_GATE_SYNC_TOKEN). - renovate.json: the new Flux-tracked images join the disabled list. - Hermes homelab-gitea-pr guide: date tag, one tag, no hand pins. Co-Authored-By: Claude Opus 5.5 --- .woodpecker/build-ci-images.yml | 21 ++++----- .woodpecker/hermes-image.yml | 7 ++- .../apps/authentik/blueprints-configmap.yaml | 5 +- kubernetes/apps/authentik/helmrelease.yaml | 14 ++---- .../hermes/skills/homelab-gitea-pr/SKILL.md | 2 +- .../references/in-house-images.md | 6 +-- .../mqtt-account-controller.yaml | 4 +- .../zigbee2mqtt-deployment.yaml | 2 +- kubernetes/apps/ical-proxy/deployment.yaml | 39 +--------------- kubernetes/apps/paperless/paperless.yaml | 2 +- kubernetes/apps/trmnl/renderer.yaml | 2 +- .../infrastructure/image-automation/README.md | 17 +++++-- .../image-automation/alpine-jq.yaml | 23 ++++++++++ .../image-automation/alpine-openssl.yaml | 23 ++++++++++ .../authentik-samba-bridge.yaml | 46 +++++++++++++++++++ .../image-automation/cni-plugins.yaml | 23 ++++++++++ .../image-automation/hermes.yaml | 7 ++- .../image-automation/ical-proxy.yaml | 23 ++++++++++ .../image-automation/kustomization.yaml | 6 +++ .../mqtt-account-controller.yaml | 23 ++++++++++ .../image-automation/shelly-manager.yaml | 9 ++-- .../image-automation/vsftpd.yaml | 9 ++-- .../infrastructure/image-automation/wiki.yaml | 7 ++- .../multus/cni-plugins-installer.yaml | 2 +- renovate.json | 7 +++ 25 files changed, 229 insertions(+), 100 deletions(-) create mode 100644 kubernetes/infrastructure/image-automation/alpine-jq.yaml create mode 100644 kubernetes/infrastructure/image-automation/alpine-openssl.yaml create mode 100644 kubernetes/infrastructure/image-automation/authentik-samba-bridge.yaml create mode 100644 kubernetes/infrastructure/image-automation/cni-plugins.yaml create mode 100644 kubernetes/infrastructure/image-automation/ical-proxy.yaml create mode 100644 kubernetes/infrastructure/image-automation/mqtt-account-controller.yaml diff --git a/.woodpecker/build-ci-images.yml b/.woodpecker/build-ci-images.yml index efde8b47..9892a3af 100644 --- a/.woodpecker/build-ci-images.yml +++ b/.woodpecker/build-ci-images.yml @@ -243,7 +243,8 @@ steps: - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n') - GH_AUTH=$(printf '%s:%s' "$GHCR_USER" "$GHCR_TOKEN" | base64 | tr -d '\n') - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"},"ghcr.io":{"auth":"%s"}}}' "$AUTH" "$GH_AUTH" > /kaniko/.docker/config.json - - TAG=$(date +%Y-%m-%d) + # konairius/ gets one tag per build: Gitea's cleanup rule counts tags. + - TAG=$(date +%Y-%m-%d-%H%M) - | /kaniko/executor \ --context . \ @@ -251,9 +252,7 @@ steps: --destination gitea.renner.uno/gitea_admin/alpine-jq:$TAG \ --destination gitea.renner.uno/gitea_admin/alpine-jq:latest \ --destination gitea.renner.uno/konairius/alpine-jq:$TAG \ - --destination gitea.renner.uno/konairius/alpine-jq:latest \ - --destination ghcr.io/konairius/alpine-jq:$TAG \ - --destination ghcr.io/konairius/alpine-jq:latest + --destination ghcr.io/konairius/alpine-jq:$TAG # Runtime image, not CI tooling: upstream containernetworking/plugins binaries # baked in, consumed by the multus cni-plugins-installer DaemonSet. Replaces a @@ -295,7 +294,8 @@ steps: - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n') - GH_AUTH=$(printf '%s:%s' "$GHCR_USER" "$GHCR_TOKEN" | base64 | tr -d '\n') - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"},"ghcr.io":{"auth":"%s"}}}' "$AUTH" "$GH_AUTH" > /kaniko/.docker/config.json - - TAG=$(date +%Y-%m-%d) + # konairius/ gets one tag per build: Gitea's cleanup rule counts tags. + - TAG=$(date +%Y-%m-%d-%H%M) - | /kaniko/executor \ --context . \ @@ -303,9 +303,7 @@ steps: --destination gitea.renner.uno/gitea_admin/cni-plugins:$TAG \ --destination gitea.renner.uno/gitea_admin/cni-plugins:latest \ --destination gitea.renner.uno/konairius/cni-plugins:$TAG \ - --destination gitea.renner.uno/konairius/cni-plugins:latest \ - --destination ghcr.io/konairius/cni-plugins:$TAG \ - --destination ghcr.io/konairius/cni-plugins:latest + --destination ghcr.io/konairius/cni-plugins:$TAG # Runtime image, not CI tooling: alpine + the openssl CLI, for shell scripts # needing s_client/x509. Named for what it is; first consumer is the paperless @@ -336,7 +334,8 @@ steps: - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n') - GH_AUTH=$(printf '%s:%s' "$GHCR_USER" "$GHCR_TOKEN" | base64 | tr -d '\n') - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"},"ghcr.io":{"auth":"%s"}}}' "$AUTH" "$GH_AUTH" > /kaniko/.docker/config.json - - TAG=$(date +%Y-%m-%d) + # konairius/ gets one tag per build: Gitea's cleanup rule counts tags. + - TAG=$(date +%Y-%m-%d-%H%M) - | /kaniko/executor \ --context . \ @@ -344,9 +343,7 @@ steps: --destination gitea.renner.uno/gitea_admin/alpine-openssl:$TAG \ --destination gitea.renner.uno/gitea_admin/alpine-openssl:latest \ --destination gitea.renner.uno/konairius/alpine-openssl:$TAG \ - --destination gitea.renner.uno/konairius/alpine-openssl:latest \ - --destination ghcr.io/konairius/alpine-openssl:$TAG \ - --destination ghcr.io/konairius/alpine-openssl:latest + --destination ghcr.io/konairius/alpine-openssl:$TAG # Heating CAN readers: open3e (Vitocal/VX3) + E3onCAN (E380 meter), one image # run as two services on edge-1. Replaces pip-into-venv on the host, where an diff --git a/.woodpecker/hermes-image.yml b/.woodpecker/hermes-image.yml index 678fff94..7fa6ca82 100644 --- a/.woodpecker/hermes-image.yml +++ b/.woodpecker/hermes-image.yml @@ -1,5 +1,5 @@ # Builds ci/images/hermes (nousresearch/hermes-agent plus the agent's CLIs) as -# gitea.renner.uno/konairius/hermes:build. and :latest. +# gitea.renner.uno/konairius/hermes:YYYY-MM-DD-HHMM, one tag per build. when: - event: push branch: main @@ -20,10 +20,9 @@ steps: - mkdir -p /kaniko/.docker - AUTH=$(printf '%s:%s' registry-bot "$GITEA_TOKEN" | base64 | tr -d '\n') - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json - - TAG="build.$(date +%s)" + - TAG=$(date +%Y-%m-%d-%H%M) - | /kaniko/executor \ --context . \ --dockerfile Containerfile \ - --destination gitea.renner.uno/konairius/hermes:$TAG \ - --destination gitea.renner.uno/konairius/hermes:latest + --destination gitea.renner.uno/konairius/hermes:$TAG diff --git a/kubernetes/apps/authentik/blueprints-configmap.yaml b/kubernetes/apps/authentik/blueprints-configmap.yaml index 3a16fa6c..52c89d45 100644 --- a/kubernetes/apps/authentik/blueprints-configmap.yaml +++ b/kubernetes/apps/authentik/blueprints-configmap.yaml @@ -705,8 +705,9 @@ data: # AND (&(sambaDomainName=...)(objectClass=sambaDomain)) # return entries instead of short-circuiting. Built from # the samba-bridge repo at - # gitea.renner.uno/konairius/authentik-samba-bridge . - container_image: gitea.renner.uno/konairius/authentik-samba-bridge-ldap-outpost:2026.8.4-3c8f413 + # gitea.renner.uno/konairius/authentik-samba-bridge ; the tag is + # tracked by Flux in helmrelease.yaml global.env. + container_image: !Env SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE object_naming_template: "ak-outpost-%(name)s" kubernetes_namespace: authentik kubernetes_replicas: 1 diff --git a/kubernetes/apps/authentik/helmrelease.yaml b/kubernetes/apps/authentik/helmrelease.yaml index 09864dcd..8e3f591a 100644 --- a/kubernetes/apps/authentik/helmrelease.yaml +++ b/kubernetes/apps/authentik/helmrelease.yaml @@ -50,15 +50,7 @@ spec: # https://gitea.renner.uno/konairius/authentik-samba-bridge . image: repository: gitea.renner.uno/konairius/authentik-samba-bridge-server - # Pinned to a specific build for two reasons: - # 1. K8s does not pull on every reschedule when tag=latest, so - # a floating tag means we don't actually pick up rebuilds - # without a manual rollout-restart (which is forbidden per - # "no pod invasion" rule). - # 2. Pinning means the deployed binary is traceable to a - # specific repo commit. Bump the tag whenever a new build - # is published from gitea.renner.uno/konairius/authentik-samba-bridge . - tag: "2026.8.4-3c8f413" + tag: "2026.8.4-3c8f413" # {"$imagepolicy": "flux-system:authentik-samba-bridge-server:tag"} envFrom: # SAMBA_BRIDGE_DOMAIN_SID / _ENABLED_GROUP / _UID_OFFSET # consumed by the bridge module at Django app startup. Missing @@ -100,6 +92,10 @@ spec: secretKeyRef: name: ldap-outpost-tls key: tls.key + # Patched LDAP outpost image, set via `!Env` in the k8s-outposts + # blueprint (blueprints-configmap.yaml). + - name: SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE + value: gitea.renner.uno/konairius/authentik-samba-bridge-ldap-outpost:2026.8.4-3c8f413 # {"$imagepolicy": "flux-system:authentik-samba-bridge-ldap-outpost"} # Key of the authentik-gate-sync API token, set via `!Env` in the # gate-sync blueprint (gate-sync.yaml). - name: AUTHENTIK_GATE_SYNC_TOKEN diff --git a/kubernetes/apps/hermes/skills/homelab-gitea-pr/SKILL.md b/kubernetes/apps/hermes/skills/homelab-gitea-pr/SKILL.md index 9d5bc020..6a53174c 100644 --- a/kubernetes/apps/hermes/skills/homelab-gitea-pr/SKILL.md +++ b/kubernetes/apps/hermes/skills/homelab-gitea-pr/SKILL.md @@ -84,7 +84,7 @@ missing permission and the one step that grants it. 9. **After the owner says "merged", verify the effect, not the merge.** Check `GET /repos///commits//statuses` for the expected `ci/woodpecker/push/` context (only cron contexts = the push pipeline never - triggered), the registry tag list for a new `build.`, `flux get images policy `, + triggered), the registry tag list for a new `YYYY-MM-DD-HHMM` tag, `flux get images policy `, and the Deployment image. Report each as observed; say plainly what you couldn't see (e.g. Woodpecker UI) instead of guessing the cause. - With several PRs in flight, query the state of every one; "merged" may mean only one diff --git a/kubernetes/apps/hermes/skills/homelab-gitea-pr/references/in-house-images.md b/kubernetes/apps/hermes/skills/homelab-gitea-pr/references/in-house-images.md index 5fae6e51..45be0c1f 100644 --- a/kubernetes/apps/hermes/skills/homelab-gitea-pr/references/in-house-images.md +++ b/kubernetes/apps/hermes/skills/homelab-gitea-pr/references/in-house-images.md @@ -7,8 +7,8 @@ Use when a homelab change adds or modifies an image built from `ci/images/ | Concern | Owner | How | |---|---|---| | Versions of base images and bundled tools | **Renovate** (`renovate.json`, `dockerfile` manager) | Express every version as an image reference: `FROM :@` and `COPY --from=:@ /usr/local/bin/`. Renovate opens the bump PR; merging it is the trigger. | -| Building the image | **Woodpecker**, on push to the default branch of `ci/images//**` (+ `event: manual`) | kaniko, tag `build.$(date +%s)` + `latest`. | -| Rolling a built tag out | **Flux image automation** | `ImageRepository` + `ImagePolicy` (`filterTags.pattern '^build\.(?P\d+)$'`, `extract '$ts'`, `numerical asc`) and the `# {"$imagepolicy": "flux-system:"}` marker on every image line. | +| Building the image | **Woodpecker**, on push to the default branch of `ci/images//**` (+ `event: manual`) | kaniko, exactly one tag `$(date +%Y-%m-%d-%H%M)`. No `latest`, `main` or sha tags: Gitea's konairius cleanup rule counts each tag as a version and keeps only the newest. | +| Rolling a built tag out | **Flux image automation** | `ImageRepository` + `ImagePolicy` (`filterTags.pattern '^\d{4}-\d{2}-\d{2}(-\d{4})?$'`, `alphabetical asc`) and the `# {"$imagepolicy": "flux-system:"}` marker on every image line. No hand-written pins. | Never add cron polling / "decide" steps that compare upstream releases — that duplicates Renovate. Never curl binaries with hand-maintained sha256 lines when the tool ships an @@ -47,4 +47,4 @@ image: `COPY --from` a digest-pinned image is tracked and needs no checksums. - Check what the base image's last `USER` is before adding one (`grep -n '^USER'` in the upstream Dockerfile). - Rollout order is two PRs: image + pipeline first; the manifest switch only with a real - `build.` (see SKILL.md, Multi-stage changes). + date tag (see SKILL.md, Multi-stage changes). diff --git a/kubernetes/apps/home-assistant/mqtt-account-controller.yaml b/kubernetes/apps/home-assistant/mqtt-account-controller.yaml index 95078a22..5bfa60b9 100644 --- a/kubernetes/apps/home-assistant/mqtt-account-controller.yaml +++ b/kubernetes/apps/home-assistant/mqtt-account-controller.yaml @@ -223,9 +223,7 @@ spec: type: RuntimeDefault containers: - name: controller - # Woodpecker builds main- on every merge to main; no sortable - # tag, so bumps are manual (same as ical-proxy). - image: gitea.renner.uno/konairius/mqtt-account-controller:main-b1f294d@sha256:8081adfee171c36cfa83734e5e7ccc3aad3debf1c0154488de70143674cde85f + image: gitea.renner.uno/konairius/mqtt-account-controller:main-b1f294d@sha256:8081adfee171c36cfa83734e5e7ccc3aad3debf1c0154488de70143674cde85f # {"$imagepolicy": "flux-system:mqtt-account-controller"} env: - name: BROKER_URL value: ssl://mosquitto.home-assistant.svc.cluster.local:8884 diff --git a/kubernetes/apps/home-assistant/zigbee2mqtt-deployment.yaml b/kubernetes/apps/home-assistant/zigbee2mqtt-deployment.yaml index 0ffa9025..cce772eb 100644 --- a/kubernetes/apps/home-assistant/zigbee2mqtt-deployment.yaml +++ b/kubernetes/apps/home-assistant/zigbee2mqtt-deployment.yaml @@ -66,7 +66,7 @@ spec: # (machine.registries.mirrors, applied by bootstrap.sh), and containerd # keeps the repository path when it falls through — so the path has to # exist on both registries. Steady state still pulls from Gitea. - image: gitea.renner.uno/konairius/alpine-jq:2026-09-04 + image: gitea.renner.uno/konairius/alpine-jq:2026-09-04 # {"$imagepolicy": "flux-system:alpine-jq"} command: - sh - -c diff --git a/kubernetes/apps/ical-proxy/deployment.yaml b/kubernetes/apps/ical-proxy/deployment.yaml index 1589bbdd..75a76424 100644 --- a/kubernetes/apps/ical-proxy/deployment.yaml +++ b/kubernetes/apps/ical-proxy/deployment.yaml @@ -17,44 +17,7 @@ spec: spec: containers: - name: ical-proxy - # Pinned to a commit build rather than :latest. - # - # :latest never rolls. The tag moves when a build publishes, but - # nothing tells the Deployment about it: the pod template is - # unchanged, so Kubernetes has no reason to replace anything, and - # this image is deliberately NOT enrolled in Flux image automation - # — see kubernetes/infrastructure/image-automation/README.md, which - # lists gitea.renner.uno/konairius/ical-proxy as having "only main, latest, - # and main- commit builds; no release tags", so there is no - # ImagePolicy watching it. The pods therefore sat on a 21-day-old - # image while :latest moved underneath them, and the only way to - # pick up a new build was a manual restart. - # - # A pinned tag makes the rollout a git change: Flux applies the new - # pod template and Kubernetes rolls it, which is also what makes - # what is RUNNING recoverable from this repo rather than "whatever - # :latest meant the last time a pod happened to restart". - # - # The image comes from the Gitea package registry, built by - # Woodpecker (.woodpecker.yml in konairius/ical-proxy) on every - # push to main. It is amd64-only and pulls without credentials, so - # no imagePullSecret. main-4783abe adds two hardening changes on - # top of main-db90a59: an SSRF guard (upstreams and redirect hops - # resolving to private/loopback/link-local addresses are refused; - # public redirects are still followed, up to 5) and a cap of 20 - # concurrent /proxy upstream fetches (over the cap: 429 + - # Retry-After). main-73b5d97 then raises the server WriteTimeout - # from 10s to 40s (the 30s upstream fetch timeout + 10s headroom), - # so a slow-but-legitimate upstream is no longer cut off before - # /proxy can answer. main-926ead0 caps the upstream response body - # at 2 MiB (larger feeds get 413 instead of being buffered whole, - # REN-230) and logs upstream fetch failures with the host, - # answering 502 instead of 500. The summary_match/summary_replace - # parameters this deployment needs are unchanged. - # - # Bumping this is a manual, reviewed edit. The tag format is - # main-, the first 7 characters of the main commit. - image: gitea.renner.uno/konairius/ical-proxy:main-926ead0 + image: gitea.renner.uno/konairius/ical-proxy:main-926ead0 # {"$imagepolicy": "flux-system:ical-proxy"} ports: - containerPort: 8080 name: http diff --git a/kubernetes/apps/paperless/paperless.yaml b/kubernetes/apps/paperless/paperless.yaml index 79b7dfb0..651465c0 100644 --- a/kubernetes/apps/paperless/paperless.yaml +++ b/kubernetes/apps/paperless/paperless.yaml @@ -155,7 +155,7 @@ spec: # exist on both registries — hence konairius/, which matches the ghcr # namespace. Steady state still pulls from Gitea and never leaves the # network. - image: gitea.renner.uno/konairius/alpine-openssl:2026-09-04 + image: gitea.renner.uno/konairius/alpine-openssl:2026-09-04 # {"$imagepolicy": "flux-system:alpine-openssl"} command: - sh - -c diff --git a/kubernetes/apps/trmnl/renderer.yaml b/kubernetes/apps/trmnl/renderer.yaml index d3571b3d..51722b98 100644 --- a/kubernetes/apps/trmnl/renderer.yaml +++ b/kubernetes/apps/trmnl/renderer.yaml @@ -184,7 +184,7 @@ spec: # (machine.registries.mirrors, applied by bootstrap.sh), and containerd # keeps the repository path, so it has to exist on both registries. # Steady state still pulls from Gitea. - image: gitea.renner.uno/konairius/alpine-jq:2026-09-04 + image: gitea.renner.uno/konairius/alpine-jq:2026-09-04 # {"$imagepolicy": "flux-system:alpine-jq"} command: - sh - -c diff --git a/kubernetes/infrastructure/image-automation/README.md b/kubernetes/infrastructure/image-automation/README.md index b4e4df60..2d3cffc5 100644 --- a/kubernetes/infrastructure/image-automation/README.md +++ b/kubernetes/infrastructure/image-automation/README.md @@ -59,12 +59,23 @@ existing `flux-system` GitRepository whose Secret was created by | firefox | `1.x` | `-rolling-daily` suffix extract; rejects arch-prefixed duplicates | | mmwave-configurator | `2.x` | Plain 3-component filter (rejects `addon-`/`-armv7`/`-arm64`/`-amd64` variants) | | cnpg-barman-plugin | `0.x` | v-prefix filter; marker lives in upstream-imported manifest (see below) | +| hermes, wiki, shelly-manager, vsftpd, ical-proxy, mqtt-account-controller, authentik-samba-bridge-{server,ldap-outpost} | `YYYY-MM-DD-HHMM` | In-house (konairius); newest tag wins | +| alpine-jq, alpine-openssl, cni-plugins | `YYYY-MM-DD-HHMM` | In-house (build-ci-images.yml, konairius/ copy); newest tag wins | + +## In-house konairius images: one tag per build + +Gitea's package cleanup rule for konairius counts every tag as one +version and keeps the most recent one. A build that pushes several tags +(sha, `main`, `latest`) leaves only the last-pushed tag, so every +konairius image is pushed with exactly one tag, `YYYY-MM-DD-HHMM` (UTC), +and every consumer follows it through an ImagePolicy rather than a +hand-written pin. ## Not enrolled (structurally impossible) - `woodpeckerci/woodpecker-cli` — the lint image in `.woodpecker/ci-manifests-test.yml`. It publishes a perfectly good - version stream (`v3.16.0-alpine`), so unlike the three below this is + version stream (`v3.16.0-alpine`), so unlike the two below this is **not** a tag-format problem. It cannot be enrolled because **image-automation can only patch YAML that is a Kubernetes manifest** — a maintainer states it plainly in fluxcd/flux2#2826: *"Flux can only @@ -87,15 +98,13 @@ existing `flux-system` GitRepository whose Secret was created by ## Not enrolled (deliberate) -These three images publish no usable version stream — there is nothing +These two images publish no usable version stream — there is nothing for image-policy to sort against: - `fauria/vsftpd` — only `:latest` is published. - `openthread/otbr` — only Ubuntu codenames (`focal`, `jammy`, `hirsute`) and `:latest`/`:test`/`:reference-device`; no semver release stream. -- `gitea.renner.uno/konairius/ical-proxy` — only `main`, `latest`, and - `main-` commit builds; no release tags. The security-scan agent will continue to surface vuln findings on these as "Skipped / Flux image-automation owns this" even without diff --git a/kubernetes/infrastructure/image-automation/alpine-jq.yaml b/kubernetes/infrastructure/image-automation/alpine-jq.yaml new file mode 100644 index 00000000..b6a2b1b3 --- /dev/null +++ b/kubernetes/infrastructure/image-automation/alpine-jq.yaml @@ -0,0 +1,23 @@ +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImageRepository +metadata: + name: alpine-jq + namespace: flux-system +spec: + image: gitea.renner.uno/konairius/alpine-jq + interval: 30m +--- +# build-ci-images.yml tags each build YYYY-MM-DD-HHMM (older builds YYYY-MM-DD); newest wins. +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImagePolicy +metadata: + name: alpine-jq + namespace: flux-system +spec: + imageRepositoryRef: + name: alpine-jq + filterTags: + pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$' + policy: + alphabetical: + order: asc diff --git a/kubernetes/infrastructure/image-automation/alpine-openssl.yaml b/kubernetes/infrastructure/image-automation/alpine-openssl.yaml new file mode 100644 index 00000000..ca942602 --- /dev/null +++ b/kubernetes/infrastructure/image-automation/alpine-openssl.yaml @@ -0,0 +1,23 @@ +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImageRepository +metadata: + name: alpine-openssl + namespace: flux-system +spec: + image: gitea.renner.uno/konairius/alpine-openssl + interval: 30m +--- +# build-ci-images.yml tags each build YYYY-MM-DD-HHMM (older builds YYYY-MM-DD); newest wins. +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImagePolicy +metadata: + name: alpine-openssl + namespace: flux-system +spec: + imageRepositoryRef: + name: alpine-openssl + filterTags: + pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$' + policy: + alphabetical: + order: asc diff --git a/kubernetes/infrastructure/image-automation/authentik-samba-bridge.yaml b/kubernetes/infrastructure/image-automation/authentik-samba-bridge.yaml new file mode 100644 index 00000000..e0aacf92 --- /dev/null +++ b/kubernetes/infrastructure/image-automation/authentik-samba-bridge.yaml @@ -0,0 +1,46 @@ +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImageRepository +metadata: + name: authentik-samba-bridge-server + namespace: flux-system +spec: + image: gitea.renner.uno/konairius/authentik-samba-bridge-server + interval: 30m +--- +# konairius/authentik-samba-bridge CI tags each build YYYY-MM-DD-HHMM; newest wins. +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImagePolicy +metadata: + name: authentik-samba-bridge-server + namespace: flux-system +spec: + imageRepositoryRef: + name: authentik-samba-bridge-server + filterTags: + pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$' + policy: + alphabetical: + order: asc +--- +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImageRepository +metadata: + name: authentik-samba-bridge-ldap-outpost + namespace: flux-system +spec: + image: gitea.renner.uno/konairius/authentik-samba-bridge-ldap-outpost + interval: 30m +--- +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImagePolicy +metadata: + name: authentik-samba-bridge-ldap-outpost + namespace: flux-system +spec: + imageRepositoryRef: + name: authentik-samba-bridge-ldap-outpost + filterTags: + pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$' + policy: + alphabetical: + order: asc diff --git a/kubernetes/infrastructure/image-automation/cni-plugins.yaml b/kubernetes/infrastructure/image-automation/cni-plugins.yaml new file mode 100644 index 00000000..c1235840 --- /dev/null +++ b/kubernetes/infrastructure/image-automation/cni-plugins.yaml @@ -0,0 +1,23 @@ +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImageRepository +metadata: + name: cni-plugins + namespace: flux-system +spec: + image: gitea.renner.uno/konairius/cni-plugins + interval: 30m +--- +# build-ci-images.yml tags each build YYYY-MM-DD-HHMM (older builds YYYY-MM-DD); newest wins. +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImagePolicy +metadata: + name: cni-plugins + namespace: flux-system +spec: + imageRepositoryRef: + name: cni-plugins + filterTags: + pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$' + policy: + alphabetical: + order: asc diff --git a/kubernetes/infrastructure/image-automation/hermes.yaml b/kubernetes/infrastructure/image-automation/hermes.yaml index aabfecd9..05c1ec26 100644 --- a/kubernetes/infrastructure/image-automation/hermes.yaml +++ b/kubernetes/infrastructure/image-automation/hermes.yaml @@ -7,7 +7,7 @@ spec: image: gitea.renner.uno/konairius/hermes interval: 10m --- -# .woodpecker/hermes-image.yml tags every build `build.`; latest push wins. +# .woodpecker/hermes-image.yml tags each build YYYY-MM-DD-HHMM; newest wins. apiVersion: image.toolkit.fluxcd.io/v1 kind: ImagePolicy metadata: @@ -17,8 +17,7 @@ spec: imageRepositoryRef: name: hermes filterTags: - pattern: '^build\.(?P\d+)$' - extract: '$ts' + pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$' policy: - numerical: + alphabetical: order: asc diff --git a/kubernetes/infrastructure/image-automation/ical-proxy.yaml b/kubernetes/infrastructure/image-automation/ical-proxy.yaml new file mode 100644 index 00000000..d63c4fd4 --- /dev/null +++ b/kubernetes/infrastructure/image-automation/ical-proxy.yaml @@ -0,0 +1,23 @@ +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImageRepository +metadata: + name: ical-proxy + namespace: flux-system +spec: + image: gitea.renner.uno/konairius/ical-proxy + interval: 30m +--- +# konairius/ical-proxy CI tags each build YYYY-MM-DD-HHMM; newest wins. +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImagePolicy +metadata: + name: ical-proxy + namespace: flux-system +spec: + imageRepositoryRef: + name: ical-proxy + filterTags: + pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$' + policy: + alphabetical: + order: asc diff --git a/kubernetes/infrastructure/image-automation/kustomization.yaml b/kubernetes/infrastructure/image-automation/kustomization.yaml index c76ef75c..e512c82d 100644 --- a/kubernetes/infrastructure/image-automation/kustomization.yaml +++ b/kubernetes/infrastructure/image-automation/kustomization.yaml @@ -2,22 +2,28 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - update-automation.yaml + - alpine-jq.yaml + - alpine-openssl.yaml - audiobookshelf.yaml - authentik-gate-sync.yaml + - authentik-samba-bridge.yaml - backup-verify.yaml - ceph.yaml - cloudflare-lb-sync.yaml + - cni-plugins.yaml - cnpg-barman-plugin.yaml - gatus.yaml - gitea-mcp.yaml - gotenberg.yaml - hermes.yaml - home-assistant.yaml + - ical-proxy.yaml - immich.yaml - kuma-sync.yaml - lidarr.yaml - matter-server.yaml - mmwave-configurator.yaml + - mqtt-account-controller.yaml - music-assistant.yaml - navidrome.yaml - netbird-ingress.yaml diff --git a/kubernetes/infrastructure/image-automation/mqtt-account-controller.yaml b/kubernetes/infrastructure/image-automation/mqtt-account-controller.yaml new file mode 100644 index 00000000..fcb756e3 --- /dev/null +++ b/kubernetes/infrastructure/image-automation/mqtt-account-controller.yaml @@ -0,0 +1,23 @@ +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImageRepository +metadata: + name: mqtt-account-controller + namespace: flux-system +spec: + image: gitea.renner.uno/konairius/mqtt-account-controller + interval: 30m +--- +# konairius/mqtt-account-controller CI tags each build YYYY-MM-DD-HHMM; newest wins. +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImagePolicy +metadata: + name: mqtt-account-controller + namespace: flux-system +spec: + imageRepositoryRef: + name: mqtt-account-controller + filterTags: + pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$' + policy: + alphabetical: + order: asc diff --git a/kubernetes/infrastructure/image-automation/shelly-manager.yaml b/kubernetes/infrastructure/image-automation/shelly-manager.yaml index fba958dc..3351507f 100644 --- a/kubernetes/infrastructure/image-automation/shelly-manager.yaml +++ b/kubernetes/infrastructure/image-automation/shelly-manager.yaml @@ -7,9 +7,7 @@ spec: image: gitea.renner.uno/konairius/shelly-manager interval: 30m --- -# CI publishes `build.` alongside SHA and `main` tags so the -# ImagePolicy has a sortable tag stream to track. Numerical desc = -# latest push wins. The SHA-only tags are filtered out by the pattern. +# konairius/shelly-manager CI tags each build YYYY-MM-DD-HHMM; newest wins. apiVersion: image.toolkit.fluxcd.io/v1 kind: ImagePolicy metadata: @@ -19,8 +17,7 @@ spec: imageRepositoryRef: name: shelly-manager filterTags: - pattern: '^build\.(?P\d+)$' - extract: '$ts' + pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$' policy: - numerical: + alphabetical: order: asc diff --git a/kubernetes/infrastructure/image-automation/vsftpd.yaml b/kubernetes/infrastructure/image-automation/vsftpd.yaml index d44a54e2..06e50a4d 100644 --- a/kubernetes/infrastructure/image-automation/vsftpd.yaml +++ b/kubernetes/infrastructure/image-automation/vsftpd.yaml @@ -7,9 +7,7 @@ spec: image: gitea.renner.uno/konairius/vsftpd interval: 30m --- -# CI publishes `build.` alongside SHA and `main` tags so the -# ImagePolicy has a sortable tag stream to track. Numerical desc = -# latest push wins. The SHA-only tags are filtered out by the pattern. +# konairius/vsftpd CI tags each build YYYY-MM-DD-HHMM; newest wins. apiVersion: image.toolkit.fluxcd.io/v1 kind: ImagePolicy metadata: @@ -19,8 +17,7 @@ spec: imageRepositoryRef: name: vsftpd filterTags: - pattern: '^build\.(?P\d+)$' - extract: '$ts' + pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$' policy: - numerical: + alphabetical: order: asc diff --git a/kubernetes/infrastructure/image-automation/wiki.yaml b/kubernetes/infrastructure/image-automation/wiki.yaml index 610cf015..3e821715 100644 --- a/kubernetes/infrastructure/image-automation/wiki.yaml +++ b/kubernetes/infrastructure/image-automation/wiki.yaml @@ -7,7 +7,7 @@ spec: image: gitea.renner.uno/konairius/wiki interval: 10m --- -# The Wiki release pipeline tags every main build `build.`; latest push wins. +# konairius/Wiki CI tags each build YYYY-MM-DD-HHMM; newest wins. apiVersion: image.toolkit.fluxcd.io/v1 kind: ImagePolicy metadata: @@ -17,8 +17,7 @@ spec: imageRepositoryRef: name: wiki filterTags: - pattern: '^build\.(?P\d+)$' - extract: '$ts' + pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$' policy: - numerical: + alphabetical: order: asc diff --git a/kubernetes/infrastructure/multus/cni-plugins-installer.yaml b/kubernetes/infrastructure/multus/cni-plugins-installer.yaml index fcf632ea..993056b4 100644 --- a/kubernetes/infrastructure/multus/cni-plugins-installer.yaml +++ b/kubernetes/infrastructure/multus/cni-plugins-installer.yaml @@ -74,7 +74,7 @@ spec: # No imagePullSecret: the ghcr namespace is private and its credential # is in machine.registries too, because a Secret would have to come # from OpenBao, which needs Ceph, which needs these binaries. - image: gitea.renner.uno/konairius/cni-plugins:2026-10-05 + image: gitea.renner.uno/konairius/cni-plugins:2026-10-05 # {"$imagepolicy": "flux-system:cni-plugins"} command: - sh - -c diff --git a/renovate.json b/renovate.json index e86a7375..2e8ad56d 100644 --- a/renovate.json +++ b/renovate.json @@ -45,7 +45,14 @@ "ghcr.io/paperless-ngx/paperless-ngx", "ghcr.io/usetrmnl/terminus", "ghcr.io/usetrmnl/trmnl-ha-amd64", + "gitea.renner.uno/konairius/alpine-jq", + "gitea.renner.uno/konairius/alpine-openssl", + "gitea.renner.uno/konairius/authentik-samba-bridge-ldap-outpost", + "gitea.renner.uno/konairius/authentik-samba-bridge-server", + "gitea.renner.uno/konairius/cni-plugins", "gitea.renner.uno/konairius/hermes", + "gitea.renner.uno/konairius/ical-proxy", + "gitea.renner.uno/konairius/mqtt-account-controller", "gitea.renner.uno/konairius/shelly-manager", "gitea.renner.uno/konairius/vsftpd", "gitea.renner.uno/konairius/wiki", -- 2.54.0