Ruben Hensen
f9111bd17b
argocd: upgrade to v3.2.12
...
One minor at a time from v2.14.2 to v3.4.12, see docs/upgrade-k8s-1.33.md.
2026-10-22 23:20:57 +02:00
Ruben Hensen
0e6e9dc323
argocd: upgrade to v3.1.16
...
One minor at a time from v2.14.2 to v3.4.12, see docs/upgrade-k8s-1.33.md.
2026-10-22 23:17:51 +02:00
Ruben Hensen
288714af21
argocd: upgrade to v3.0.23
...
One minor at a time from v2.14.2 to v3.4.12, see docs/upgrade-k8s-1.33.md.
2026-10-22 23:14:17 +02:00
Ruben Hensen
66debf1e3c
argocd: keep label-based resource tracking explicitly
...
Argo CD 3.0 switches the default to annotation tracking. Per the 2.14->3.0
upgrade notes, a resource whose first sync after the switch is a deletion
gets orphaned instead of pruned. Pinning label tracking (the 2.14 default,
so no change today) keeps the upgrade to 3.x free of that; moving to
annotations can follow once everything runs 3.4.
2026-10-22 23:13:11 +02:00
Ruben Hensen
7acb7eaa8c
Move every ExternalSecret and the ClusterSecretStore to external-secrets.io/v1
...
ESO 0.16.2 is the one release that serves both v1beta1 and v1. 0.17
stops serving v1beta1, so manifests still on v1beta1 would fail to sync
from the next hop on. For these resources the schemas are name-identical
(conversion strategy None); only the apiVersion changes.
2026-10-22 21:41:28 +02:00
Ruben Hensen
fe678d4b4b
ca-bundle: also serve argocd, authentik and actual-budget
...
Those three namespaces had their own ~190KB copy of patched-ca-bundle.
Let the ca-bundle chart render them too, so the bundle lives in one file.
2026-10-22 09:26:43 +02:00
Ruben Hensen
a507282103
argocd: mount a CA bundle without the compromised eMudhra roots
...
The Argo CD v2.14.2 image (Ubuntu 24.04, ca-certificates 20240203) and the
dex image still trust the eMudhra intermediates whose keys leaked
(https://emudhra.we-have-a-problem.com ), and the repo server fetches git
and Helm repos over that trust store. A forged certificate there means
arbitrary manifests in the cluster.
patched-ca-bundle holds the bundle from Alpine ca-certificates-bundle
20261020-r0 and replaces /etc/ssl/certs in every Argo CD container except
redis. The whole directory goes, since OpenSSL and Go also read the
per-root files next to ca-certificates.crt. It uses server-side apply to
keep the bundle out of the last-applied annotation.
2026-10-21 12:09:41 +02:00
Ruben Hensen
dc85d89904
Add oidc secret for argocd
2026-04-06 18:52:21 +02:00
Ruben Hensen
0fd7bf1135
Add OIDC to argocd
2026-04-06 18:44:32 +02:00
Ruben Hensen
faaf6b6729
Remove most hensen.io refs and move from stalwart.rubenhensen.nl to mail.rubenhensen.nl
2026-04-06 18:09:24 +02:00
Ruben Hensen
c51c98e821
Add rubenhensen.nl to all ingresses
2026-03-15 11:46:24 +01:00
Ruben Hensen
a04745a409
Add traccar client ingress
2025-03-09 13:00:02 +01:00
Ruben Hensen
21e94bea61
Exclude velero backup resource in argocd 5
2025-03-04 14:18:58 +01:00
Ruben Hensen
20ba930963
Exclude velero backup resource in argocd 4
2025-03-04 14:14:51 +01:00
Ruben Hensen
ebd1bd058a
Exclude velero backup resource in argocd 3
2025-03-04 14:14:22 +01:00
Ruben Hensen
174fa1157e
Exclude velero backup resource in argocd 2
2025-03-04 14:13:32 +01:00
Ruben Hensen
a48c522974
Exclude velero backup resource in argocd
2025-03-04 14:11:48 +01:00
Ruben Hensen
929b4c6355
Add github webhook secret
2025-03-04 14:04:37 +01:00
Ruben Hensen
a30ad0678e
Add github webhook secret
2025-03-04 14:04:04 +01:00
Ruben Hensen
d9a4356c6a
Add github webhook secret
2025-03-04 14:01:05 +01:00
Ruben Hensen
8a01918922
Update argocd
2025-02-26 13:40:51 +01:00
Ruben Hensen
b5aa614bcb
Add immich helm with common probe(?)
2024-12-15 19:07:55 +01:00
Ruben Hensen
5809a43ef1
Add patch file
2024-12-14 22:09:49 +01:00
Ruben Hensen
7161fe8612
Add patch to argocd 6
2024-12-14 22:09:05 +01:00
Ruben Hensen
3730aa6c80
Add patch to argocd 5
2024-12-14 22:08:37 +01:00
Ruben Hensen
b285253141
Add patch to argocd 4
2024-12-14 22:04:58 +01:00
Ruben Hensen
a5f48a393b
Add patch to argocd 3
2024-12-14 22:03:25 +01:00
Ruben Hensen
6ce1b96486
Add patch to argocd 2
2024-12-14 22:02:19 +01:00
Ruben Hensen
159467b8b2
Add patch to argocd
2024-12-14 22:01:38 +01:00
Ruben Hensen
8881f391f4
Update argocd
2024-12-14 19:22:33 +01:00
Ruben Hensen
e6ecb86a70
Re-add longhorn ingress with subdomain and basic auth
2024-12-14 19:15:01 +01:00
Ruben Hensen
56b42423a5
Change argocd version 2.14.2
2024-10-03 15:05:37 +02:00
Ruben Hensen
d9c8db718e
Change argocd version 2
2024-10-03 15:04:39 +02:00
Ruben Hensen
73e26b175d
Change argocd version
2024-10-03 15:02:25 +02:00
Ruben Hensen
6e39a5b871
Add overlay patches 17
2024-09-14 22:12:34 +02:00
Ruben Hensen
b7af897a23
Add overlay patches 16
2024-09-14 22:09:45 +02:00
Ruben Hensen
d515c302f3
Add overlay patches 15
2024-09-14 22:07:02 +02:00
Ruben Hensen
d79c96f264
Add overlay patches 14
2024-09-14 22:05:53 +02:00
Ruben Hensen
014efbd992
Add overlay patches 13
2024-09-14 22:01:13 +02:00
Ruben Hensen
bcaef18260
Add overlay patches 12
2024-09-14 22:00:12 +02:00
Ruben Hensen
f1514d3167
Add overlay patches 12
2024-09-14 21:59:23 +02:00
Ruben Hensen
de2f38d8c9
Add overlay patches 11
2024-09-14 21:56:42 +02:00
Ruben Hensen
45440b2a89
Add overlay patches 10
2024-09-14 21:51:09 +02:00
Ruben Hensen
efb5e52aaf
Add overlay patches 9
2024-09-14 21:50:22 +02:00
Ruben Hensen
d7aaa18677
Add overlay patches 8
2024-09-14 21:46:46 +02:00
Ruben Hensen
60fd168938
Add overlay patches 7
2024-09-14 21:42:32 +02:00
Ruben Hensen
7b2b203f1d
Add overlay patches 6
2024-09-14 21:40:40 +02:00
Ruben Hensen
bff6d2675e
Add overlay patches 5
2024-09-14 21:40:07 +02:00
Ruben Hensen
63c14604b8
Add overlay patches 4
2024-09-14 21:38:33 +02:00
Ruben Hensen
54c3674148
Add overlay patches 3
2024-09-14 21:38:10 +02:00
Ruben Hensen