Bumps every outdated image and chart except databases, which are deliberately left on their current versions. Applications: authentik 2026.5.2 -> 2026.8.0 (server and worker) immich v2.7.5 -> v3.1.0 gitea 1.25 -> 1.27.2 gotify 2.9.1 -> 3.0.0 uptime-kuma 2.2.1 -> 2.5.3 zipline 4.5.3 -> 4.7.0 outline 1.8.1 -> 1.9.2 reactive-resume v5.0 -> v5.2.8 netbootxyz nbxyz18 -> nbxyz24 bentopdf v2.8.2 -> v2.8.7 jellyfin 10.11.9 -> 10.11.11 gitea runner init busybox 1.37.0 -> 1.38.0 Infra: kube-vip v0.9.1 -> v1.2.3 victoria-metrics-k8s-stack 0.77.0 -> 0.91.2 intel-device-plugins v0.35.0 -> v0.36.0 crowdsec-envoy-bouncer 0.6.3 -> 0.8.0 Immich v3 drops pgvecto.rs support. Verified the live database already runs vchord 0.4.3 and pgvector 0.8.1 with no pgvecto.rs extension, both inside the ranges v3 accepts, so no database change is required. The victoria-metrics chart renamed defaultRules.create to defaultRules.enabled at both the top level and per group. Migrated those keys so the etcd, kubeScheduler, kubernetesSystemControllerManager and kubernetesSystemScheduler exclusions keep applying. Without the rename those groups revert to enabled and alert on control-plane components that k3s runs embedded. That chart also moved default rules and dashboards to a runtime sync job instead of templating them, so ArgoCD will prune the VMRules and dashboard ConfigMaps it currently owns and the job will recreate them. kube-vip is not managed by ArgoCD. The manifest change is inert until applied by hand.
165 lines
7.8 KiB
YAML
165 lines
7.8 KiB
YAML
# Configure Gitea Actions
|
|
## @section Gitea Actions
|
|
#
|
|
## @param enabled Create an act runner StatefulSet.
|
|
## @param init.image.repository The image used for the init containers
|
|
## @param init.image.tag The image tag used for the init containers
|
|
## @param statefulset.replicas the amount of (replica) runner pods deployed
|
|
## @param statefulset.timezone is the timezone that will be set in the act_runner image
|
|
## @param statefulset.annotations Act runner annotations
|
|
## @param statefulset.labels Act runner labels
|
|
## @param statefulset.resources Act runner resources
|
|
## @param statefulset.nodeSelector NodeSelector for the statefulset
|
|
## @param statefulset.tolerations Tolerations for the statefulset
|
|
## @param statefulset.affinity Affinity for the statefulset
|
|
## @param statefulset.extraVolumes Extra volumes for the statefulset
|
|
## @param statefulset.actRunner.repository The Gitea act runner image
|
|
## @param statefulset.actRunner.tag The Gitea act runner tag
|
|
## @param statefulset.actRunner.pullPolicy The Gitea act runner pullPolicy
|
|
## @param statefulset.actRunner.extraVolumeMounts Allows mounting extra volumes in the act runner container
|
|
## @param statefulset.actRunner.config [default: Too complex. See values.yaml] Act runner custom configuration. See [Act Runner documentation](https://docs.gitea.com/usage/actions/act-runner#configuration) for details.
|
|
## @param statefulset.dind.repository The Docker-in-Docker image
|
|
## @param statefulset.dind.tag The Docker-in-Docker image tag
|
|
## @param statefulset.dind.pullPolicy The Docker-in-Docker pullPolicy
|
|
## @param statefulset.dind.extraVolumeMounts Allows mounting extra volumes in the Docker-in-Docker container
|
|
## @param statefulset.dind.extraEnvs Allows adding custom environment variables, such as `DOCKER_IPTABLES_LEGACY`
|
|
## @param statefulset.persistence.size Size for persistence to store act runner data
|
|
## @param existingSecret Secret that contains the token
|
|
## @param existingSecretKey Secret key
|
|
## @param giteaRootURL URL the act_runner registers and connect with
|
|
enabled: true
|
|
statefulset:
|
|
replicas: 1
|
|
timezone: Europe/Brussels
|
|
annotations: {}
|
|
labels: {}
|
|
resources: {}
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|
|
extraVolumes: []
|
|
|
|
actRunner:
|
|
registry: docker.io
|
|
repository: gitea/act_runner
|
|
tag: 0.2.13
|
|
pullPolicy: IfNotPresent
|
|
extraVolumeMounts: []
|
|
|
|
# See full example here: https://gitea.com/gitea/act_runner/src/branch/main/internal/pkg/config/config.example.yaml
|
|
config: |
|
|
log:
|
|
level: debug
|
|
runner:
|
|
# Where to store the registration result.
|
|
file: .runner
|
|
# The timeout for a job to be finished.
|
|
# Please note that the Gitea instance also has a timeout (3h by default) for the job.
|
|
# So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
|
|
timeout: 3h
|
|
# The timeout for the runner to wait for running jobs to finish when shutting down.
|
|
# Any running jobs that haven't finished after this timeout will be cancelled.
|
|
shutdown_timeout: 0s
|
|
# Whether skip verifying the TLS certificate of the Gitea instance.
|
|
insecure: false
|
|
# The timeout for fetching the job from the Gitea instance.
|
|
fetch_timeout: 5s
|
|
# The interval for fetching the job from the Gitea instance.
|
|
fetch_interval: 2s
|
|
labels:
|
|
- "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
|
|
- "ubuntu-22.04:docker://gitea/runner-images:ubuntu-22.04"
|
|
cache:
|
|
# Enable cache server to use actions/cache.
|
|
enabled: true
|
|
# The directory to store the cache data.
|
|
# If it's empty, the cache data will be stored in $HOME/.cache/actcache.
|
|
dir: ""
|
|
# The host of the cache server.
|
|
# It's not for the address to listen, but the address to connect from job containers.
|
|
# So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
|
|
host: ""
|
|
# The port of the cache server.
|
|
# 0 means to use a random available port.
|
|
port: 0
|
|
# The external cache server URL. Valid only when enable is true.
|
|
# If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
|
|
# The URL should generally end with "/".
|
|
external_server: ""
|
|
container:
|
|
# Specifies the network to which the container will connect.
|
|
# Could be host, bridge or the name of a custom network.
|
|
# If it's empty, act_runner will create a network automatically.
|
|
network: "host"
|
|
# Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
|
|
privileged: true
|
|
# And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
|
|
options:
|
|
# The parent directory of a job's working directory.
|
|
# NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically.
|
|
# If the path starts with '/', the '/' will be trimmed.
|
|
# For example, if the parent directory is /path/to/my/dir, workdir_parent should be path/to/my/dir
|
|
# If it's empty, /workspace will be used.
|
|
workdir_parent:
|
|
# Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
|
|
# You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
|
|
# For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
|
|
# valid_volumes:
|
|
# - data
|
|
# - /src/*.json
|
|
# If you want to allow any volume, please use the following configuration:
|
|
# valid_volumes:
|
|
# - '**'
|
|
valid_volumes: [/var/run/docker.sock]
|
|
# overrides the docker client host with the specified one.
|
|
# If it's empty, act_runner will find an available docker host automatically.
|
|
# If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
|
|
# If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
|
|
docker_host: ""
|
|
# Pull docker image(s) even if already present
|
|
force_pull: false
|
|
# Rebuild docker image(s) even if already present
|
|
force_rebuild: false
|
|
# Always require a reachable docker daemon, even if not required by act_runner
|
|
require_docker: false
|
|
# Timeout to wait for the docker daemon to be reachable, if docker is required by require_docker or act_runner
|
|
docker_timeout: 0s
|
|
dind:
|
|
repository: docker
|
|
tag: 28.3.3-dind
|
|
pullPolicy: IfNotPresent
|
|
extraVolumeMounts: []
|
|
|
|
# If the container keeps crashing in your environment, you might have to add the `DOCKER_IPTABLES_LEGACY` environment variable.
|
|
# See https://github.com/docker-library/docker/issues/463#issuecomment-1881909456
|
|
extraEnvs:
|
|
[]
|
|
# - name: "DOCKER_IPTABLES_LEGACY"
|
|
# value: "1"
|
|
|
|
persistence:
|
|
size: 15Gi
|
|
|
|
init:
|
|
image:
|
|
repository: busybox
|
|
# Overrides the image tag whose default is the chart appVersion.
|
|
tag: "1.38.0"
|
|
|
|
## Specify an existing token secret
|
|
##
|
|
existingSecret: "gitea-secrets"
|
|
existingSecretKey: "runner_token"
|
|
|
|
## Specify the root URL of the Gitea instance
|
|
giteaRootURL: "https://gitea.jsme.be"
|
|
|
|
## @section Global
|
|
#
|
|
## @param global.imageRegistry global image registry override
|
|
## @param global.storageClass global storage class override
|
|
global:
|
|
imageRegistry: ""
|
|
storageClass: ""
|
|
|