All five installed plugins have 12.0.0.0 targetAbi builds available. The
archived 9p4 SSO Authentication plugin has been removed, since it has no
v12 build and is being replaced by an OIDC plugin later.
Plugins must be updated from the Jellyfin dashboard after the rollout;
the container upgrade does not touch /config/plugins.
The API server defaults group on allowedRoutes.kinds and certificateRefs,
and group, kind and weight on the TCPRoute backendRefs. Omitting them left
both ArgoCD apps permanently OutOfSync against the live objects. Matches
what authentik-httproute.yaml already does.
Adds the LDAP outpost deployment and routes ports 389 and 636 on
gateway-internal to it. 636 is a TLS listener in Terminate mode so
cert-manager renews the LDAPS certificate automatically, and both
listeners forward to the outpost's plaintext 3389.
allowedRoutes.kinds is set explicitly on both listeners: a TCP listener
permits no route kinds by default and a TLS listener defaults to
TLSRoute, so the TCPRoute would not attach otherwise.
Swept into d5e0731 by the same stray `git add -u`. Unlike argocd-install
this one is synced, so it went live; reverting here rolls the cluster back
to connectionIdleTimeout 3600s with no retry block.
The content is still reachable at d5e0731 if it is wanted back.
The earlier rule covered creationTimestamp, volumeMode and status but missed
apiVersion and kind, which the API server also injects into
volumeClaimTemplates. Those two alone kept both StatefulSets permanently
OutOfSync: a sync would apply successfully and report Synced, then the very
next comparison flagged them again.
gitea-runner-pvc referenced volumeName gitea-runner-data, but neither that
PV nor a Longhorn volume of that name exists, so it sat Pending since May.
ArgoCD treats a Pending PVC as Progressing and rolled that up to the whole
app, which is why gitea never reported Healthy.
Nothing mounted it. The runner uses the PVC the gitea/actions chart
generates from its own volumeClaimTemplate.
The kubelet probes the pod IP, which Django rejects with a 400 because
ALLOWED_HOSTS is netbox.jsme.be. Setting the Host header keeps
ALLOWED_HOSTS tight instead of widening it to '*'.
Five components under applications/netbox: the web pod, an rqworker,
a daily housekeeping CronJob, postgres 18 and two valkey instances.
The task queue runs appendonly on its own PVC so queued jobs survive a
restart, while the cache instance is disposable.
Worker and cronjob override args rather than command, which replaces
CMD while keeping tini as the entrypoint, so only the web pod runs
migrations. Media, reports and scripts share one RWX PVC via subPaths
because both the web pod and the worker mount them.
Exposed on the internal gateway only.
The console will not work from outside without this. WebsocketController hands
the browser wss://<node fqdn>:443/api/servers/<uuid>/ws built from
Node::getConnectionAddress(), so the browser talks to wings directly and never
through the panel. Same for file upload and download, which FileUploadController
builds from the same address. Everything else (login, server list, file
browsing, power actions, sending console commands) already worked publicly,
because those go through the panel API.
Adds public listeners for both nodes reusing the existing wings-mc-tls and
wings-ark-tls certificates, and a gateway-public parentRef on each route.
Extends the wings ClientTrafficPolicy to the two new listeners. Without it the
public listeners would negotiate h2 and long-lived consoles would drop: wings
only speaks HTTP/1.1, and the idle timeout needs to be 3600s rather than the
default.
CrowdSec ext_authz already covers every listener on gateway-public, so both
nodes are behind the WAF and community blocklist from the moment they are live.
Wings itself is JWT-gated and returns 401 unauthenticated.
Adds a pelican listener to gateway-public and a gateway-public parentRef to
pelican-route. Reuses the existing pelican-tls certificate, which both
listeners reference.
Wings deliberately stays internal-only. That is a real functional limit, not
an oversight: the browser talks to wings directly for the console websocket
and for file upload/download, using the address from Node::getConnectionAddress.
From outside the LAN those calls will fail. Panel login, server list, file
browsing and editing, and power actions all go through the panel API and keep
working, because the panel reaches wings server-side over the internal gateway.
CrowdSec ext_authz already covers every listener on gateway-public, so the
panel is behind the WAF and community blocklist from the moment it is live.
Prerequisites completed first: TRUSTED_PROXIES=10.42.0.0/16 and
APP_2FA_REQUIRED=1 set in Infisical and verified live in the panel config.
pelican.jsme.be has no public DNS record yet, so this makes the panel reachable
through 10.8.11.105 but not from the internet. The Azure DNS CNAME in the
OpenTofu repo is the actual cutover.
The ghcr.io/pelican-dev/panel package is no longer anonymously pullable
(token endpoint returns DENIED for every tag, package page 404s). Upstream
renamed the org to "pelican" in beta38 and compose.yml now points at
ghcr.io/pelican/panel. Verified a real pull of v1.0.0-beta38 from the new
location succeeds.
Pinning the tag also replaces :latest, which combined with IfNotPresent meant
the running version depended on whatever the node happened to have cached.
beta36 was clean against all six published advisories, but four of them landed
in the last five months, so a deliberate patch path matters here.
beta37/38 carry no breaking changes or manual migration steps. beta37 fixes
Passkeys origin validation, which is wanted before enrolling 2FA.
Bumps every outdated image and chart except databases, which are
deliberately left on their current versions.
Applications:
authentik 2026.5.2 -> 2026.8.0 (server and worker)
immich v2.7.5 -> v3.1.0
gitea 1.25 -> 1.27.2
gotify 2.9.1 -> 3.0.0
uptime-kuma 2.2.1 -> 2.5.3
zipline 4.5.3 -> 4.7.0
outline 1.8.1 -> 1.9.2
reactive-resume v5.0 -> v5.2.8
netbootxyz nbxyz18 -> nbxyz24
bentopdf v2.8.2 -> v2.8.7
jellyfin 10.11.9 -> 10.11.11
gitea runner init busybox 1.37.0 -> 1.38.0
Infra:
kube-vip v0.9.1 -> v1.2.3
victoria-metrics-k8s-stack 0.77.0 -> 0.91.2
intel-device-plugins v0.35.0 -> v0.36.0
crowdsec-envoy-bouncer 0.6.3 -> 0.8.0
Immich v3 drops pgvecto.rs support. Verified the live database already
runs vchord 0.4.3 and pgvector 0.8.1 with no pgvecto.rs extension, both
inside the ranges v3 accepts, so no database change is required.
The victoria-metrics chart renamed defaultRules.create to
defaultRules.enabled at both the top level and per group. Migrated those
keys so the etcd, kubeScheduler, kubernetesSystemControllerManager and
kubernetesSystemScheduler exclusions keep applying. Without the rename
those groups revert to enabled and alert on control-plane components
that k3s runs embedded.
That chart also moved default rules and dashboards to a runtime sync job
instead of templating them, so ArgoCD will prune the VMRules and
dashboard ConfigMaps it currently owns and the job will recreate them.
kube-vip is not managed by ArgoCD. The manifest change is inert until
applied by hand.
Both ran as BestEffort QoS, making them first in line for eviction under node memory pressure. Requests also give the scheduler real numbers to place them with.
Flat CR narrowed to recursive: false; it still serves the SMB mount credentials and the Actions runner token, which the runner Helm chart reads via existingSecret.
Folds the pelican-config ConfigMap into Infisical so the container has a single envFrom. Pins imagePullPolicy to IfNotPresent because ghcr.io/pelican-dev/panel no longer allows anonymous pulls.
All 31 env entries, secrets and literals alike, now live in Infisical under /outline/outline and /outline/postgres. Manifest rationale carried across as Infisical secret comments.
Both ran as BestEffort QoS, making them first in line for eviction
under node memory pressure. Requests also give the scheduler real
numbers to place them with.
Jeffrey