4 Commits
Author SHA1 Message Date
Jeffrey 7a937dae07 gitea: drop the orphaned runner pvc that could never bind
gitea-runner-pvc referenced volumeName gitea-runner-data, but neither that
PV nor a Longhorn volume of that name exists, so it sat Pending since May.
ArgoCD treats a Pending PVC as Progressing and rolled that up to the whole
app, which is why gitea never reported Healthy.

Nothing mounted it. The runner uses the PVC the gitea/actions chart
generates from its own volumeClaimTemplate.
2026-08-29 18:00:28 +02:00
Jeffrey a57860a576 Update application and chart versions to latest
Bumps every outdated image and chart except databases, which are
deliberately left on their current versions.

Applications:
  authentik       2026.5.2 -> 2026.8.0 (server and worker)
  immich          v2.7.5 -> v3.1.0
  gitea           1.25 -> 1.27.2
  gotify          2.9.1 -> 3.0.0
  uptime-kuma     2.2.1 -> 2.5.3
  zipline         4.5.3 -> 4.7.0
  outline         1.8.1 -> 1.9.2
  reactive-resume v5.0 -> v5.2.8
  netbootxyz      nbxyz18 -> nbxyz24
  bentopdf        v2.8.2 -> v2.8.7
  jellyfin        10.11.9 -> 10.11.11
  gitea runner init busybox 1.37.0 -> 1.38.0

Infra:
  kube-vip                    v0.9.1 -> v1.2.3
  victoria-metrics-k8s-stack  0.77.0 -> 0.91.2
  intel-device-plugins        v0.35.0 -> v0.36.0
  crowdsec-envoy-bouncer      0.6.3 -> 0.8.0

Immich v3 drops pgvecto.rs support. Verified the live database already
runs vchord 0.4.3 and pgvector 0.8.1 with no pgvecto.rs extension, both
inside the ranges v3 accepts, so no database change is required.

The victoria-metrics chart renamed defaultRules.create to
defaultRules.enabled at both the top level and per group. Migrated those
keys so the etcd, kubeScheduler, kubernetesSystemControllerManager and
kubernetesSystemScheduler exclusions keep applying. Without the rename
those groups revert to enabled and alert on control-plane components
that k3s runs embedded.

That chart also moved default rules and dashboards to a runtime sync job
instead of templating them, so ArgoCD will prune the VMRules and
dashboard ConfigMaps it currently owns and the job will recreate them.

kube-vip is not managed by ArgoCD. The manifest change is inert until
applied by hand.
2026-08-24 23:12:22 +02:00
Jeffrey 0177c73fa9 gitea: migrate to envFrom with per-container InfisicalSecrets
Flat CR narrowed to recursive: false; it still serves the SMB mount credentials and the Actions runner token, which the runner Helm chart reads via existingSecret.
2026-08-24 00:20:29 +02:00
Jeffrey c40577589d Split manifests into infra/ and applications/ 2026-06-21 12:23:20 +02:00