rubenhensen/k8scd
1
0 Fork 0
mirror of https://github.com/rubenhensen/k8scd.git synced 2026-11-15 22:29:09 +01:00
Code Issues Packages Projects Releases Wiki Activity
1,319 Commits 27 Branches 0 Tags
01470a260cb4740cb4c6f3e0a267f2d7bddc6695
Commit Graph
1319 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ruben Hensen 01470a260c docs: tick off Argo CD 3.4.12 2026-10-22 23:39:14 +02:00
Ruben Hensen f174ddee8f argocd: upgrade to v3.4.12 
One minor at a time from v2.14.2 to v3.4.12, see docs/upgrade-k8s-1.33.md.
 2026-10-22 23:31:54 +02:00
Ruben Hensen 62043940e8 argocd: upgrade to v3.3.18 
One minor at a time from v2.14.2 to v3.4.12, see docs/upgrade-k8s-1.33.md.
 2026-10-22 23:25:46 +02:00
Ruben Hensen 8a60dbc5ea argocd: sync Argo CD itself with server-side apply 
Required from 3.3, whose ApplicationSet CRD no longer fits the last-applied annotation of client-side apply. Turned on while still on 3.2 so the managed-field migration happens before the CRD grows.
 2026-10-22 23:25:28 +02:00
Ruben Hensen f9111bd17b argocd: upgrade to v3.2.12 
One minor at a time from v2.14.2 to v3.4.12, see docs/upgrade-k8s-1.33.md.
 2026-10-22 23:20:57 +02:00
Ruben Hensen 0e6e9dc323 argocd: upgrade to v3.1.16 
One minor at a time from v2.14.2 to v3.4.12, see docs/upgrade-k8s-1.33.md.
 2026-10-22 23:17:51 +02:00
Ruben Hensen 288714af21 argocd: upgrade to v3.0.23 
One minor at a time from v2.14.2 to v3.4.12, see docs/upgrade-k8s-1.33.md.
 2026-10-22 23:14:17 +02:00
Ruben Hensen 66debf1e3c argocd: keep label-based resource tracking explicitly 
Argo CD 3.0 switches the default to annotation tracking. Per the 2.14->3.0
upgrade notes, a resource whose first sync after the switch is a deletion
gets orphaned instead of pruned. Pinning label tracking (the 2.14 default,
so no change today) keeps the upgrade to 3.x free of that; moving to
annotations can follow once everything runs 3.4.
 2026-10-22 23:13:11 +02:00
Ruben Hensen 108455de9c docs: tick off External Secrets 2.13.0 2026-10-22 23:07:32 +02:00
Ruben Hensen 69444a4ac0 external-secrets: upgrade to 2.13.0 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 23:03:25 +02:00
Ruben Hensen 30bc62a453 external-secrets: upgrade to 2.12.0 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 22:59:28 +02:00
Ruben Hensen 2b7b1799a4 external-secrets: upgrade to 2.11.0 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 22:55:59 +02:00
Ruben Hensen 00de7483d4 external-secrets: upgrade to 2.10.0 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 22:52:12 +02:00
Ruben Hensen bde9245497 external-secrets: upgrade to 2.9.0 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 22:48:24 +02:00
Ruben Hensen c2bece55d2 external-secrets: upgrade to 2.8.0 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 22:45:16 +02:00
Ruben Hensen 0bf2245c26 external-secrets: upgrade to 2.7.0 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 22:41:28 +02:00
Ruben Hensen af99a17ff4 external-secrets: upgrade to 2.6.0 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 22:38:20 +02:00
Ruben Hensen 8cc26bb412 external-secrets: upgrade to 2.5.0 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 22:34:53 +02:00
Ruben Hensen c6424cc4a5 external-secrets: upgrade to 2.4.1 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 22:31:04 +02:00
Ruben Hensen 12a1f80902 external-secrets: upgrade to 2.3.0 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 22:27:15 +02:00
Ruben Hensen 39cc61236f external-secrets: upgrade to 2.2.0 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 22:23:28 +02:00
Ruben Hensen 42fc278f74 external-secrets: upgrade to 2.1.0 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 22:19:41 +02:00
Ruben Hensen 94fc9aeb52 external-secrets: upgrade to 2.0.1 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 22:16:04 +02:00
Ruben Hensen 724afbf4f7 external-secrets: upgrade to 1.3.2 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 22:12:17 +02:00
Ruben Hensen cef4466925 external-secrets: upgrade to 1.2.1 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 22:08:29 +02:00
Ruben Hensen 660cb82922 external-secrets: upgrade to 1.1.1 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 22:02:19 +02:00
Ruben Hensen f31a31cfde external-secrets: upgrade to 1.0.0 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 21:59:01 +02:00
Ruben Hensen 4b7682f12e external-secrets: upgrade to 0.20.4 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 21:55:04 +02:00
Ruben Hensen 3b5708fd64 external-secrets: upgrade to 0.19.2 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 21:51:17 +02:00
Ruben Hensen 6cac51ebfa external-secrets: upgrade to 0.18.2 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 21:47:31 +02:00
Ruben Hensen c5bb001287 external-secrets: upgrade to 0.17.0 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 21:42:52 +02:00
Ruben Hensen 7acb7eaa8c Move every ExternalSecret and the ClusterSecretStore to external-secrets.io/v1 
ESO 0.16.2 is the one release that serves both v1beta1 and v1. 0.17
stops serving v1beta1, so manifests still on v1beta1 would fail to sync
from the next hop on. For these resources the schemas are name-identical
(conversion strategy None); only the apiVersion changes.
 2026-10-22 21:41:28 +02:00
Ruben Hensen 9e31727298 external-secrets: upgrade to 0.16.2 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 21:26:42 +02:00
Ruben Hensen e62728027b external-secrets: upgrade to 0.15.1 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 21:23:25 +02:00
Ruben Hensen 183686ea34 external-secrets: upgrade to 0.14.4 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 21:20:19 +02:00
Ruben Hensen 950d4807f2 external-secrets: upgrade to 0.13.0 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 21:16:40 +02:00
Ruben Hensen 3db1ee84a5 external-secrets: upgrade to 0.12.1 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 21:02:10 +02:00
Ruben Hensen 04e862d453 external-secrets: upgrade to 0.11.0 
One minor at a time from 0.10.7 to 2.13.0, see docs/upgrade-k8s-1.33.md.
 2026-10-22 20:53:13 +02:00
Ruben Hensen 096eb60f8c external-secrets: sync with server-side apply 
Needed from ESO 0.19, whose CRDs are too big for client-side apply. Turned on now, on 0.10.7, so Argo CD migrates the managed fields before the upgrade starts.
 2026-10-22 20:51:55 +02:00
Ruben Hensen 2a2594a987 docs: tick off CloudNativePG 1.30.1 and the Vault chart 2026-10-22 16:27:13 +02:00
Ruben Hensen b86942077a vault: recreate the injector instead of rolling it 
Dropping the anti-affinity wasn't enough: during the rollout the old ReplicaSet kept recreating its pod with the old anti-affinity, which still blocked the new one. Recreate stops the old pod first; nothing uses the injector, so the short gap doesn't matter.
 2026-10-22 16:22:59 +02:00
Ruben Hensen 6b81033f70 vault: drop the injector's anti-affinity 
The chart requires injector pods on different nodes. With one node and one replica the rolling update to vault-k8s 1.7.6 deadlocked: the new pod stayed Pending until the old one left, which waits for the new one. The server already sets affinity to "" for the same reason.
 2026-10-22 16:11:13 +02:00
Ruben Hensen e518e1368f vault: upgrade the chart to 0.34.1, keep the server on 1.17.2 
Chart 0.28.1 is only tested up to Kubernetes 1.30. 0.34.1 brings the
injector to vault-k8s 1.7.6. The server image is pinned to the running
1.17.2: the StatefulSet uses OnDelete, so nothing restarts now, but a
later pod restart would otherwise pull the chart's default and Shamir
unsealing needs the keys at hand for a Vault upgrade. Rendered with the
pin, the StatefulSet only changes in formatting and an extra check in the
config script that doesn't apply here.
 2026-10-22 16:06:28 +02:00
Ruben Hensen 9b9bd8bad0 cnpg: upgrade operator to 1.30.1 (chart 0.29.1) 
One minor at a time from 1.25.1 to 1.30.1, see docs/upgrade-k8s-1.33.md. In-place instance manager updates keep the database pods running.
 2026-10-22 15:52:41 +02:00
Ruben Hensen 7eb69b17e1 cnpg: upgrade operator to 1.29.1 (chart 0.28.3) 
One minor at a time from 1.25.1 to 1.30.1, see docs/upgrade-k8s-1.33.md. In-place instance manager updates keep the database pods running.
 2026-10-22 15:49:27 +02:00
Ruben Hensen b0ed6fdad1 cnpg: upgrade operator to 1.28.1 (chart 0.27.1) 
One minor at a time from 1.25.1 to 1.30.1, see docs/upgrade-k8s-1.33.md. In-place instance manager updates keep the database pods running.
 2026-10-22 15:46:02 +02:00
Ruben Hensen 9cf0c7f9e9 cnpg: upgrade operator to 1.27.1 (chart 0.26.1) 
One minor at a time from 1.25.1 to 1.30.1, see docs/upgrade-k8s-1.33.md. In-place instance manager updates keep the database pods running.
 2026-10-22 15:42:35 +02:00
Ruben Hensen 8a409c6a5b cnpg: upgrade operator to 1.26.1 (chart 0.25.0) 
One minor at a time from 1.25.1 to 1.30.1, see docs/upgrade-k8s-1.33.md. In-place instance manager updates keep the database pods running.
 2026-10-22 15:35:58 +02:00
Ruben Hensen 8cb8b28cd9 cnpg: prepare for the operator upgrade to 1.30 
Pin authentik-postgres to the image CNPG filled in at creation
(postgresql:17.4). Later operators default to PostgreSQL 18, and since
1.26 a higher major in the image triggers an offline in-place major
upgrade. immich-postgres already pins its pgvecto.rs image.

Turn on ENABLE_INSTANCE_MANAGER_INPLACE_UPDATES so the five operator hops
(1.25 -> 1.30, one minor at a time as the docs recommend) swap the
instance manager inside the running pods instead of restarting both
single-instance databases each time.
 2026-10-22 15:35:18 +02:00
Ruben Hensen bdbabde317 docs: tick off Velero 1.16.2 
Test backup of gatus and ntfy completed on the new version.
 2026-10-22 15:32:57 +02:00