Merge pull request 'Update image ghcr.io/siderolabs/kubelet to v1.31.2' (#838) from renovate/ghcr.io-siderolabs-kubelet-1.x into main

Reviewed-on: #838

.gitignore

@@ -24,3 +24,6 @@ omniconfig.yaml
 *.pem
 *.secrets
 config.xml
+
+# syncthing
+**/*sync-conflict*

kubernetes/apps/ai/ollama/app/helmrelease.yaml

@@ -35,7 +35,7 @@ spec:
           app:
             image:
               repository: docker.io/ollama/ollama
-              tag: 0.4.0
+              tag: 0.4.1
             env:
               - name: OLLAMA_HOST
                 value: 0.0.0.0

kubernetes/apps/anime/kustomization.yaml

@@ -9,5 +9,5 @@ resources:
   - ./jellyfin/ks.yaml    # sqlite
   - ./jellyseerr/ks.yaml  # sqlite
   - ./radarr/ks.yaml      # postgres
-  - ./shoko/ks.yaml       # sqlite
+  # - ./shoko/ks.yaml       # sqlite
   - ./sonarr/ks.yaml      # postgres

kubernetes/apps/anime/shoko/app/externalsecret.yaml

@@ -1,31 +0,0 @@
----
-# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: shokoserver
-spec:
-  refreshInterval: 5m
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: onepassword-connect
-  target:
-    name: shokoserver-secret
-    creationPolicy: Owner
-  data:
-    - secretKey: WIREGUARD_ENDPOINT_IP
-      remoteRef:
-        key: ProtonVPN
-        property: shokoserver_vpn_endpoint_ip
-    - secretKey: WIREGUARD_PUBLIC_KEY
-      remoteRef:
-        key: ProtonVPN
-        property: shokoserver_wireguard_public_key
-    - secretKey: WIREGUARD_PRIVATE_KEY
-      remoteRef:
-        key: ProtonVPN
-        property: shokoserver_wireguard_private_key
-    - secretKey: WIREGUARD_ADDRESSES
-      remoteRef:
-        key: ProtonVPN
-        property: wireguard_addresses

kubernetes/apps/anime/shoko/app/helmrelease.yaml

@@ -1,125 +0,0 @@
----
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: &app shokoserver
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.5.1
-      sourceRef:
-        kind: HelmRepository
-        name: bjw-s
-        namespace: flux-system
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    cleanupOnFail: true
-    remediation:
-      strategy: rollback
-      retries: 3
-  dependsOn:
-    - name: rook-ceph-cluster
-      namespace: rook-ceph
-    - name: volsync
-      namespace: volsync-system
-  values:
-    controllers:
-      shokoserver:
-        annotations:
-          reloader.stakater.com/auto: "true"
-        initContainers:
-          gluetun:
-            image:
-              repository: ghcr.io/qdm12/gluetun
-              tag: v3.39.1
-            env:
-              DOT: "off"
-              VPN_SERVICE_PROVIDER: protonvpn
-              VPN_TYPE: wireguard
-              VPN_INTERFACE: wg0
-              FIREWALL_INPUT_PORTS: "80"
-            envFrom:
-              - secretRef:
-                  name: shokoserver-secret
-            resources:
-              limits:
-                kernel.org/tun: 1
-            restartPolicy: Always
-            securityContext:
-              capabilities:
-                add: ["NET_ADMIN"]
-              allowPrivilegeEscalation: false
-        containers:
-          app:
-            image:
-              repository: ghcr.io/jahanson/shokoserver
-              tag: v5.0.0@sha256:193aedf3e3f2d7031a76274d5bae0004c3d920c24831d688d991f85d4bb24ce2
-            env:
-              TZ: America/Chicago
-              PORT: &port 80
-            # probes:
-            #   liveness: &probes
-            #     enabled: true
-            #     custom: true
-            #     spec:
-            #       httpGet:
-            #         path: /status
-            #         port: *port
-            #       initialDelaySeconds: 0
-            #       periodSeconds: 10
-            #       timeoutSeconds: 1
-            #       failureThreshold: 3
-            #   readiness: *probes
-            #   startup:
-            #     enabled: false
-            securityContext:
-              allowPrivilegeEscalation: false
-              readOnlyRootFilesystem: true
-              capabilities: { drop: ["ALL"] }
-    defaultPodOptions:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 568
-        runAsGroup: 568
-        fsGroup: 568
-        fsGroupChangePolicy: OnRootMismatch
-        seccompProfile: { type: RuntimeDefault }
-    service:
-      app:
-        controller: shokoserver
-        ports:
-          http:
-            port: *port
-            targetPort: 8111
-    ingress:
-      app:
-        className: internal-nginx
-        hosts:
-          - host: "${APP}.jahanson.tech"
-            paths:
-              - path: /
-                service:
-                  identifier: app
-                  port: http
-    persistence:
-      config:
-        existingClaim: "${APP}"
-        globalMounts:
-          - path: /.shoko
-      media:
-        type: nfs
-        server: 10.1.1.61
-        path: /moria/media/
-        globalMounts:
-          - path: /data/moria-media
-      # logs:
-      #   type: emptyDir
-      #   globalMounts:
-      #     - path: /app/config/logs
-      tmp:
-        type: emptyDir

kubernetes/apps/default/autobrr/app/helmrelease.yaml

@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/autobrr/autobrr
-              tag: v1.48.0@sha256:0ae19e3beedf491396e450b024c23e9e24df4d692286c0442a81fa699493def0
+              tag: v1.49.0@sha256:dc2195ccabf8438a8f8eb0581c5e6d2a40c061754e57552bc4f67f1b20a71970
             env:
               AUTOBRR__CHECK_FOR_UPDATES: "false"
               AUTOBRR__HOST: 0.0.0.0

kubernetes/apps/default/home-assistant/app/helmrelease.yaml

@@ -36,7 +36,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/home-assistant
-              tag: 2024.11.0@sha256:23a1ba70e7d5518527e6324d28ccb07f1cbf7c334dbb6326a0b413ef8fe5fafd
+              tag: 2024.11.1@sha256:a3dd7577c28771702b21f817ad86600056467c2c7f45d261a1e7241910ddc2e2
             env:
               TZ: America/Chicago
             envFrom:
@@ -54,7 +54,7 @@ spec:
           code-server:
             image:
               repository: ghcr.io/coder/code-server
-              tag: 4.93.1@sha256:c69e398d1b64589b3b77a7becfd03f4ec524982def20e6bffbb51b1b839e72ba
+              tag: 4.95.1@sha256:d9bc7797d997e1b199e333676732e075bac4bae276dc0fe1baece2e313edfa09
             args: [
               "--auth", "none",
               "--user-data-dir", "/config/.vscode",

kubernetes/apps/default/kustomization.yaml

@@ -16,7 +16,6 @@ resources:
   - ./morphos/ks.yaml
   - ./omegabrr/ks.yaml
   - ./overseerr/ks.yaml
-  - ./piped/ks.yaml
   - ./plex/ks.yaml
   - ./prowlarr/ks.yaml
   - ./radarr/ks.yaml

kubernetes/apps/default/maintainerr/app/helmrelease.yaml

@@ -32,7 +32,7 @@ spec:
           app:
             image:
               repository: ghcr.io/jorenn92/maintainerr
-              tag: 2.2.0@sha256:fbb2c0341b8af502e4488f3664e34992f24947708c7dac10dcbee592f99a946c
+              tag: 2.2.1@sha256:13121a8292ef6db7560a931bf19b601cf3cc12df0a9dea9086b757798eea5b6d
             env:
               TZ: America/Chicago
             resources:

kubernetes/apps/default/omegabrr/app/helmrelease.yaml

@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/autobrr/omegabrr
-              tag: v1.14.0@sha256:6f65c7967609746662815933ecc8168c8c25a3b82d909f49833fcce2b47ee052
+              tag: v1.15.0@sha256:4f6099a76ff9d248e9f032e29c04a92b483f21456e46f3b01eb20399f4732ad0
             env:
               TZ: America/Chicago
             securityContext:

kubernetes/apps/default/plex/trakt-sync/helmrelease.yaml

@@ -33,7 +33,7 @@ spec:
           app:
             image:
               repository: ghcr.io/taxel/plextraktsync
-              tag: 0.32.0
+              tag: 0.32.1
             args:
               - sync
             env:

kubernetes/apps/default/scrypted/app/helmrelease.yaml

@@ -32,7 +32,7 @@ spec:
           app:
             image:
               repository: ghcr.io/koush/scrypted
-              tag: v0.123.0-jammy-nvidia
+              tag: v0.123.1-jammy-nvidia
             probes:
               liveness:
                 enabled: true

kubernetes/apps/kube-system/generic-device-plugin/app/helmrelease.yaml

@@ -0,0 +1,67 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: generic-device-plugin
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  driftDetection:
+    mode: enabled
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    defaultPodOptions:
+      priorityClassName: system-node-critical
+    controllers:
+      generic-device-plugin:
+        type: daemonset
+        strategy: RollingUpdate
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          generic-device-plugin:
+            image:
+              repository: ghcr.io/squat/generic-device-plugin
+              tag: latest@sha256:ba6f0b4cf6c858d6ad29ba4d32e4da11638abbc7d96436bf04f582a97b2b8821
+            args:
+              - --config=/config/config.yml
+            ports:
+              - containerPort: 8080
+                name: http
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+    persistence:
+      config:
+        type: configMap
+        name: generic-device-plugin-configmap
+        globalMounts:
+          - path: /config/config.yml
+            subPath: config.yml
+            readOnly: true
+      dev:
+        type: hostPath
+        hostPath: /dev
+        globalMounts:
+          - path: /dev
+      device-plugin:
+        type: hostPath
+        hostPath: /var/lib/kubelet/device-plugins
+        globalMounts:
+          - path: /var/lib/kubelet/device-plugins

kubernetes/apps/kube-system/generic-device-plugin/app/kustomization.yaml

@@ -3,7 +3,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./externalsecret.yaml
   - ./helmrelease.yaml
-  - ../../../../templates/gatus/internal
+configMapGenerator:
-  - ../../../../templates/volsync
+  - name: generic-device-plugin-configmap
+    files:
+      - ./resources/config.yml
+generatorOptions:
+  disableNameSuffixHash: true

kubernetes/apps/kube-system/generic-device-plugin/app/resources/config.yml

@@ -0,0 +1,9 @@
+---
+log-level: info
+domain: kernel.org
+devices:
+  - name: tun
+    groups:
+      - count: 1000
+        paths:
+          - path: /dev/net/tun

kubernetes/apps/kube-system/generic-device-plugin/ks.yaml

@@ -3,22 +3,18 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: &app shoko
+  name: &app generic-device-plugin
   namespace: flux-system
 spec:
-  targetNamespace: anime
+  targetNamespace: kube-system
   commonMetadata:
     labels:
       app.kubernetes.io/name: *app
-  path: ./kubernetes/apps/anime/shoko/app
+  path: "./kubernetes/apps/kube-system/generic-device-plugin/app"
   prune: true
   sourceRef:
     kind: GitRepository
     name: theshire
-  wait: false
+  wait: true
   interval: 30m
   timeout: 5m
-  postBuild:
-    substitute:
-      APP: *app
-      VOLSYNC_CAPACITY: 5Gi

kubernetes/apps/kube-system/kustomization.yaml

@@ -12,6 +12,7 @@ resources:
   - ./descheduler/ks.yaml
   - ./dnsimple-webhook-rbac.yaml
   - ./fstrim/ks.yaml
+  - ./generic-device-plugin/ks.yaml
   - ./kubelet-csr-approver/ks.yaml
   - ./metrics-server/ks.yaml
   - ./node-feature-discovery/ks.yaml

kubernetes/apps/observability/prometheus-operator-crds/app/helmrelease.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: prometheus-operator-crds
-      version: 15.0.0
+      version: 16.0.0
       sourceRef:
         kind: HelmRepository
         name: prometheus-community

kubernetes/apps/qbittorrent/flood/app/helmrelease.yaml

@@ -43,7 +43,7 @@ spec:
           app:
             image:
               repository: jesec/flood
-              tag: master@sha256:8d04ec24abcc879f14e744e809520f7a7ec3c66395e1f6efa4179c9399803fbe
+              tag: master@sha256:8a18a3509a6c1557b769873a1ef85dcd5fa4cbce1a939be2c6c87f97eb79de45
             envFrom:
               - secretRef:
                   name: flood-secret

kubernetes/bootstrap/helmfile.yaml

@@ -19,7 +19,7 @@ releases:
   - name: prometheus-operator-crds
     namespace: observability
     chart: oci://ghcr.io/prometheus-community/charts/prometheus-operator-crds
-    version: 15.0.0
+    version: 16.0.0
   - name: cilium
     namespace: kube-system
     chart: cilium/cilium

kubernetes/bootstrap/talos/talconfig.yaml

@@ -1,9 +1,11 @@
 ---
-# yaml-language-server: $schema=https://ks.hsn.dev/talconfig.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/budimanjojo/talhelper/master/pkg/config/schemas/talconfig.json
 clusterName: theshire
 
-talosVersion: v1.8.2
+# renovate: datasource=github-releases depName=siderolabs/talos
-kubernetesVersion: 1.31.1
+talosVersion: v1.8.1
+# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
+kubernetesVersion: 1.31.2
 endpoint: "https://10.1.1.57:6444"
 
 additionalApiServerCertSans: