diff --git a/ansible/roles/docker_node/defaults/main.yml b/ansible/roles/docker_node/defaults/main.yml index 66fe0206..6916e18d 100644 --- a/ansible/roles/docker_node/defaults/main.yml +++ b/ansible/roles/docker_node/defaults/main.yml @@ -5,7 +5,7 @@ docker_defaults: apt_repo: key: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88 package_name: docker-ce - package_ver: 5:29.6.1-1~ubuntu.26.04~resolute + package_ver: 5:29.7.2-1~ubuntu.26.04~resolute repo: deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu {{ ansible_facts['distribution_release'] }} stable url: https://download.docker.com/linux/ubuntu/gpg certs: diff --git a/ansible/roles/kubernetes/defaults/main.yml b/ansible/roles/kubernetes/defaults/main.yml index f075bda0..0653c3f5 100644 --- a/ansible/roles/kubernetes/defaults/main.yml +++ b/ansible/roles/kubernetes/defaults/main.yml @@ -13,9 +13,9 @@ k8s_defaults: admin_config: /etc/kubernetes/admin.conf config_fetch_always: false apt_repo: - # TODO parameterize hardcoded 1.35 value - repo: deb [signed-by=/etc/apt/keyrings/kubernetes.asc] https://pkgs.k8s.io/core:/stable:/v1.35/deb/ / - url: https://pkgs.k8s.io/core:/stable:/v1.35/deb/Release.key + # TODO parameterize hardcoded 1.36 value + repo: deb [signed-by=/etc/apt/keyrings/kubernetes.asc] https://pkgs.k8s.io/core:/stable:/v1.36/deb/ / + url: https://pkgs.k8s.io/core:/stable:/v1.36/deb/Release.key cplane_hostip: "{{ hostvars[groups['k8s_cplane'][0]]['ansible_default_ipv4']['address'] | default(groups['k8s_cplane'][0]) }}" cplane_vip: "{{ hostvars[groups['k8s_cplane'][0]]['ansible_default_ipv4']['address'] | default(groups['k8s_cplane'][0]) }}" # TODO: might be able to retire cri-dockerd @@ -31,9 +31,9 @@ k8s_defaults: name: kubelet state: restarted service_network: 10.96.0.0/12 - version: 1.35.4 - coredns_version: v1.13.1 - cni_version: 1.8.0 + version: 1.36.4 + coredns_version: v1.14.2 + cni_version: 1.9.1 k8s_override: {} k8s: "{{ k8s_defaults | combine(k8s_override) }}" diff --git a/ansible/roles/kubernetes/templates/kubeadm-config-cplane.j2 b/ansible/roles/kubernetes/templates/kubeadm-config-cplane.j2 new file mode 100644 index 00000000..2a54ae2f --- /dev/null +++ b/ansible/roles/kubernetes/templates/kubeadm-config-cplane.j2 @@ -0,0 +1,97 @@ +--- +{{ ansible_managed | comment }} +apiVersion: kubeadm.k8s.io/v1beta4 +kind: InitConfiguration +bootstrapTokens: +- token: {{ vault_k8s.join_token }} + ttl: 1h0m0s + usages: + - signing + - authentication + groups: + - system:bootstrappers:kubeadm:default-node-token +localAPIEndpoint: + advertiseAddress: {{ k8s.cplane_hostip }} + bindPort: 6443 +nodeRegistration: + criSocket: {{ k8s.cri_socket }} + imagePullPolicy: IfNotPresent + imagePullSerial: true + name: {{ ansible_fqdn }} + taints: + - effect: NoSchedule + key: node-role.kubernetes.io/control-plane + +# Some default values, uncomment and modify as desired +# timeouts: +# controlPlaneComponentHealthCheck: 4m0s +# discovery: 5m0s +# etcdAPICall: 2m0s +# kubeletHealthCheck: 4m0s +# kubernetesAPICall: 1m0s +# tlsBootstrap: 5m0s +# upgradeManifests: 5m0s +--- +apiVersion: kubeadm.k8s.io/v1beta4 +kind: ClusterConfiguration +apiServer: + certSANs: + - {{ k8s.cplane_hostip }} + - {{ k8s.cplane_vip }} + extraArgs: + - name: encryption-provider-config + value: /etc/kubernetes/local/api-crypt.conf + - name: oidc-issuer-url + value: {{ oidc.issuer_url }} + - name: oidc-client-id + value: {{ oidc.client_id }} + - name: oidc-username-claim + value: {{ oidc.username_claim }} + - name: oidc-groups-claim + value: {{ oidc.groups_claim }} + - name: oidc-username-prefix + value: {{ oidc.username_prefix }} + - name: oidc-groups-prefix + value: {{ oidc.group_prefix }} + - name: oidc-ca-file + value: {{ oidc.ca_file }} + extraVolumes: + - name: local-config + hostPath: "/etc/kubernetes/local" + mountPath: "/etc/kubernetes/local" + readOnly: true + pathType: DirectoryOrCreate +featureGates: + # TODO remove when https works for kubectl exec + ExtendWebSocketsToKubelet: false +controlPlaneEndpoint: "{{ k8s.cplane_vip }}:6443" +dns: + # Workaround for bug 112131; never got fixed as of k8s 1.31: + # https://github.com/kubernetes/kubernetes/issues/112131 + imageRepository: registry.k8s.io/coredns + imageTag: {{ k8s.coredns_version }} +imageRepository: registry.k8s.io +kubernetesVersion: v{{ k8s.version }} +networking: + dnsDomain: cluster.local + podSubnet: {{ k8s.pod_network }} + serviceSubnet: {{ k8s.service_network }} + +# Some default values, uncomment and modify as desired +# caCertificateValidityPeriod: 87600h0m0s +# certificateValidityPeriod: 8760h0m0s +# certificatesDir: /etc/kubernetes/pki +# clusterName: kubernetes +# controllerManager: {} +# encryptionAlgorithm: RSA-2048 +# etcd: +# local: +# dataDir: /var/lib/etcd +--- +apiVersion: kubelet.config.k8s.io/v1beta1 +kind: KubeletConfiguration +containerLogMaxFiles: 3 +containerLogMaxSize: 50Mi +featureGates: + # TODO remove when https works for kubectl exec + ExtendWebSocketsToKubelet: false diff --git a/images/dhcpd-dns-pxe/Dockerfile b/images/dhcpd-dns-pxe/Dockerfile index 56fd2746..4230bcbf 100644 --- a/images/dhcpd-dns-pxe/Dockerfile +++ b/images/dhcpd-dns-pxe/Dockerfile @@ -9,7 +9,7 @@ LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \ org.label-schema.vcs-ref=$VCS_REF \ org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools ARG KEA_VERSION=3.0.3-r0 -ARG DNSMASQ_VERSION=2.92_p2-r0 +ARG DNSMASQ_VERSION=2.93-r0 ENV DB_HOST=db00 \ DB_NAME=kea \ @@ -39,7 +39,9 @@ ENV DB_HOST=db00 \ TFTP_SERVER=self \ TZ=UTC -RUN apk add --no-cache --update kea=$KEA_VERSION dnsmasq=$DNSMASQ_VERSION \ +RUN echo "@edge https://dl-cdn.alpinelinux.org/alpine/edge/main" \ + >> /etc/apk/repositories && \ + apk add --no-cache --update kea=$KEA_VERSION dnsmasq@edge=$DNSMASQ_VERSION \ kea-admin kea-hook-mysql mariadb-client && \ mkdir -m 755 /run/kea && chown kea /run/kea diff --git a/images/dhcpd-dns-pxe/helm/Chart.yaml b/images/dhcpd-dns-pxe/helm/Chart.yaml index ee2129c6..2dff1307 100644 --- a/images/dhcpd-dns-pxe/helm/Chart.yaml +++ b/images/dhcpd-dns-pxe/helm/Chart.yaml @@ -8,7 +8,7 @@ sources: - http://thekelleys.org.uk/gitweb/?p=dnsmasq.git type: application version: 0.2.3 -appVersion: "3.0.3-r0-2.92_p2-r0" +appVersion: "3.0.3-r0-2.93-r0" dependencies: - name: chartlib version: 0.1.8 diff --git a/images/dovecot/Dockerfile b/images/dovecot/Dockerfile index cee649b7..6227b1c0 100644 --- a/images/dovecot/Dockerfile +++ b/images/dovecot/Dockerfile @@ -9,7 +9,7 @@ LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \ org.label-schema.vcs-ref=$VCS_REF \ org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools -ARG DOVECOT_VERSION=2.4.4-r0 +ARG DOVECOT_VERSION=2.4.5-r0 ARG PROCMAIL_VERSION=3.22-r4 ARG MKCERT_SHA=d1efad065f9ef34da372847ff4a4d5ffd86b97410b303d8a43ea25aa2119c86d ARG PROCMAIL_SHA=4ac9f21c3d7dbed5b32e7547da39f4d429de480679b4c856026caea39ca842f9 @@ -30,7 +30,9 @@ RUN cd /tmp && \ wget -q https://dl-cdn.alpinelinux.org/alpine/v3.11/main/armv7/procmail-$PROCMAIL_VERSION.apk ;; \ *) echo Unrecognized ${TARGETPLATFORM} ;; \ esac && \ - apk add --no-cache dovecot=$DOVECOT_VERSION dovecot-ldap=$DOVECOT_VERSION && \ + echo "@edge https://dl-cdn.alpinelinux.org/alpine/edge/main" \ + >> /etc/apk/repositories && \ + apk add --no-cache dovecot@edge=$DOVECOT_VERSION dovecot-ldap@edge=$DOVECOT_VERSION && \ apk add --allow-untrusted procmail-$PROCMAIL_VERSION.apk && \ cd /usr/local/bin && \ wget -q https://raw.githubusercontent.com/dovecot/core/release-2.4.1/doc/mkcert.sh && \ diff --git a/images/dovecot/helm/Chart.yaml b/images/dovecot/helm/Chart.yaml index 6510d5ad..ad2d4b3b 100644 --- a/images/dovecot/helm/Chart.yaml +++ b/images/dovecot/helm/Chart.yaml @@ -6,8 +6,8 @@ sources: - https://github.com/instantlinux/docker-tools - https://github.com/vdukhovni/dovecot type: application -version: 0.1.16 -appVersion: "2.4.4-r0" +version: 0.1.17 +appVersion: "2.4.5-r0" dependencies: - name: chartlib version: 0.1.8 diff --git a/images/haproxy-keepalived/Dockerfile b/images/haproxy-keepalived/Dockerfile index 7f908391..a5737b71 100644 --- a/images/haproxy-keepalived/Dockerfile +++ b/images/haproxy-keepalived/Dockerfile @@ -1,4 +1,4 @@ -FROM haproxy:3.3.11-alpine +FROM haproxy:3.4.4-alpine ARG BUILD_DATE ARG VCS_REF LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \ diff --git a/images/haproxy-keepalived/helm/Chart.yaml b/images/haproxy-keepalived/helm/Chart.yaml index dce6e9eb..55f97e33 100644 --- a/images/haproxy-keepalived/helm/Chart.yaml +++ b/images/haproxy-keepalived/helm/Chart.yaml @@ -7,9 +7,8 @@ sources: - https://github.com/haproxy/haproxy - https://github.com/acassen/keepalived type: application -version: 0.1.23 -appVersion: "3.3.11-alpine-2.3.4-r2" -#appVersion: "3.3.10-alpine-2.3.4-r3" +version: 0.1.24 +appVersion: "3.4.4-alpine-2.3.4-r2" dependencies: - name: chartlib version: 0.1.8 diff --git a/images/nagios/Dockerfile b/images/nagios/Dockerfile index 1f3ad812..7cc73493 100644 --- a/images/nagios/Dockerfile +++ b/images/nagios/Dockerfile @@ -8,17 +8,17 @@ LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \ org.label-schema.vcs-ref=$VCS_REF \ org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools -ARG NAGIOS_VERSION=4.5.13-r0 +ARG NAGIOS_VERSION=4.5.14-r0 ARG NAGIOS_GID=1000 ARG NAGIOS_UID=999 ARG PLUGINS_VERSION=2.5-r0 ARG WWW_UID=33 ENV AUTHORIZED_USERS=nagiosadmin \ CONFIG_CHECK=yes \ - HTPASSWD_SECRET=nagios-htpasswd \ - MAIL_AUTH_USER= \ - MAIL_AUTH_SECRET=nagios-mail-secret \ + HTPASSWD_SECRETNAME=nagios-htpasswd \ MAIL_RELAY_HOST=smtp:25 \ + MAIL_RELAY_SECRETNAME=nagios-mail-secret \ + MAIL_RELAY_USER= \ MAIL_USE_TLS=yes \ NAGIOS_FQDN=nagios.docker \ NGINX_PORT=80 \ @@ -29,7 +29,9 @@ RUN addgroup -g $NAGIOS_GID nagios && \ adduser -g www-data -u $WWW_UID -DSH -h /var/www www-data && \ adduser -G nagios -g "Nagios Server" -DSH -h /var/nagios -u $NAGIOS_UID \ nagios && \ - apk add --update --no-cache nagios=$NAGIOS_VERSION nagios-web \ + echo "@edge https://dl-cdn.alpinelinux.org/alpine/edge/main" \ + >> /etc/apk/repositories && \ + apk add --update --no-cache nagios@edge=$NAGIOS_VERSION nagios-web \ nagios-plugins-all=$PLUGINS_VERSION \ nagios-plugins-mysql=$PLUGINS_VERSION \ nrpe-plugin bash curl fcgiwrap file mariadb-client nginx openssl \ @@ -51,4 +53,4 @@ VOLUME /etc/nagios /opt/nagios/plugins /var/nagios COPY nginx.conf /etc/nginx/http.d/nagios.conf COPY php-fpm-www.conf /etc/php83/php-fpm.d/www.conf COPY entrypoint.sh mail.sh /usr/local/bin/ -ENTRYPOINT /usr/local/bin/entrypoint.sh +ENTRYPOINT [ "/usr/local/bin/entrypoint.sh" ] diff --git a/images/nagios/README.md b/images/nagios/README.md index 7dd75870..0a5b78e3 100644 --- a/images/nagios/README.md +++ b/images/nagios/README.md @@ -41,10 +41,10 @@ Variable | Default | Description | ADMIN_PATH | /opt | Path on localhost (for adding local plugins, etc) AUTHORIZED_USERS | nagiosadmin | List of users CONFIG_CHECK | yes | Whether to halt on startup if config-check fails -HTPASSWD_SECRET | nagios-htpasswd | Secret holding basic-auth user/passwords -MAIL_AUTH_USER | | Auth for SMTP relay provider -MAIL_AUTH_SECRET | nagios-mail-secret | Name of secret containing mail password +HTPASSWD_SECRETNAME | nagios-htpasswd | Secret holding basic-auth user/passwords MAIL_RELAY_HOST | smtp:25 | FQDN and port of SMTP relay +MAIL_RELAY_SECRETNAME | nagios-mail-secret | Name of secret containing mail password +MAIL_RELAY_USER | | Auth for SMTP relay provider MAIL_USE_TLS | yes | Whether to encrypt with TLS and STARTTLS NAGIOS_MAIL_RELAY | smtp | DNS name for nagios email sending NAGIOS_FQDN | nagios.docker | server_name for nginx diff --git a/images/nut-upsd/Dockerfile b/images/nut-upsd/Dockerfile index e4f2b373..ef023c41 100644 --- a/images/nut-upsd/Dockerfile +++ b/images/nut-upsd/Dockerfile @@ -8,7 +8,7 @@ LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \ org.label-schema.name=nut-upsd \ org.label-schema.vcs-ref=$VCS_REF \ org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools -ARG NUT_VERSION=2.8.3-r4 +ARG NUT_VERSION=2.8.5-r1 ENV ACTIONS= \ API_USER=upsmon \ API_PASSWORD= \ @@ -35,8 +35,10 @@ ENV ACTIONS= \ HEALTHCHECK CMD upsc $NAME@localhost:3493 2>&1|grep -q stale && \ killall -TERM upsmon || true -RUN apk add --no-cache dash && \ - apk add --update --no-cache nut=$NUT_VERSION \ +RUN echo "@edge https://dl-cdn.alpinelinux.org/alpine/edge/community" \ + >> /etc/apk/repositories && \ + apk add --no-cache dash && \ + apk add --update --no-cache nut@edge=$NUT_VERSION \ busybox curl linux-pam libcrypto3 libexpat libssl3 libusb musl \ net-snmp-libs util-linux musl-utils nghttp2-libs diff --git a/images/nut-upsd/helm/Chart.yaml b/images/nut-upsd/helm/Chart.yaml index cf673e69..0278021e 100644 --- a/images/nut-upsd/helm/Chart.yaml +++ b/images/nut-upsd/helm/Chart.yaml @@ -6,8 +6,8 @@ sources: - https://github.com/instantlinux/docker-tools - https://github.com/networkupstools/nut type: application -version: 0.1.12 -appVersion: "2.8.3-r4" +version: 0.1.13 +appVersion: "2.8.5-r1" dependencies: - name: chartlib version: 0.1.8 diff --git a/images/openldap/Dockerfile b/images/openldap/Dockerfile index 7ea2b185..aef6f4e2 100644 --- a/images/openldap/Dockerfile +++ b/images/openldap/Dockerfile @@ -9,7 +9,7 @@ LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \ org.label-schema.vcs-ref=$VCS_REF \ org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools -ARG OPENLDAP_VERSION=2.6.13-r0 +ARG OPENLDAP_VERSION=2.6.14-r0 ENV SLAPD_DN_ATTR=uid \ SLAPD_FQDN=example.com \ SLAPD_LOG_LEVEL=Config,Stats \ diff --git a/images/openldap/helm/Chart.yaml b/images/openldap/helm/Chart.yaml index ff4306a9..d517c3fd 100644 --- a/images/openldap/helm/Chart.yaml +++ b/images/openldap/helm/Chart.yaml @@ -6,8 +6,8 @@ sources: - https://github.com/instantlinux/docker-tools - https://git.openldap.org/openldap/openldap type: application -version: 0.1.9 -appVersion: "2.6.13-r0" +version: 0.1.10 +appVersion: "2.6.14-r0" dependencies: - name: chartlib version: 0.1.8 diff --git a/images/postfix-python/Dockerfile b/images/postfix-python/Dockerfile index 0d3947ee..1a441481 100644 --- a/images/postfix-python/Dockerfile +++ b/images/postfix-python/Dockerfile @@ -1,4 +1,4 @@ -ARG POSTFIX_VERSION=3.11.5-r0 +ARG POSTFIX_VERSION=3.11.6-r0 FROM instantlinux/postfix:$POSTFIX_VERSION ARG BUILD_DATE diff --git a/images/postfix-python/helm/Chart.yaml b/images/postfix-python/helm/Chart.yaml index e823b410..4964df71 100644 --- a/images/postfix-python/helm/Chart.yaml +++ b/images/postfix-python/helm/Chart.yaml @@ -6,8 +6,8 @@ sources: - https://github.com/instantlinux/docker-tools - https://github.com/vdukhovni/postfix type: application -version: 0.1.24 -appVersion: "3.11.5-r0" +version: 0.1.25 +appVersion: "3.11.6-r0" dependencies: - name: chartlib version: 0.1.8 diff --git a/images/postfix/Dockerfile b/images/postfix/Dockerfile index ea6776ce..7dacfd2f 100644 --- a/images/postfix/Dockerfile +++ b/images/postfix/Dockerfile @@ -8,7 +8,7 @@ LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \ org.label-schema.name=postfix \ org.label-schema.vcs-ref=$VCS_REF \ org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools -ARG POSTFIX_VERSION=3.11.5-r0 +ARG POSTFIX_VERSION=3.11.6-r0 ENV SASL_SECRETNAME=postfix-sasl-passwd \ TZ=UTC diff --git a/k8s/helm/immich/Chart.yaml b/k8s/helm/immich/Chart.yaml index 5632b918..5ea3c024 100644 --- a/k8s/helm/immich/Chart.yaml +++ b/k8s/helm/immich/Chart.yaml @@ -6,7 +6,7 @@ sources: - https://github.com/immich-app/immich - https://github.com/instantlinux/docker-tools type: application -version: 0.1.1 +version: 0.1.2 # Reminder, update tag for ml instance in values.yaml appVersion: v3.0.1 dependencies: @@ -20,5 +20,5 @@ dependencies: version: 0.1.0 repository: file://subcharts/postgres - name: valkey - version: 0.1.0 + version: 0.1.1 repository: file://subcharts/valkey diff --git a/k8s/helm/immich/subcharts/valkey/Chart.yaml b/k8s/helm/immich/subcharts/valkey/Chart.yaml index ffd54242..af73c069 100644 --- a/k8s/helm/immich/subcharts/valkey/Chart.yaml +++ b/k8s/helm/immich/subcharts/valkey/Chart.yaml @@ -6,7 +6,7 @@ sources: - https://github.com/instantlinux/docker-tools - https://hub.docker.com/r/valkey/valkey type: application -version: 0.1.0 +version: 0.1.1 appVersion: "9.1.0-alpine" dependencies: - name: chartlib diff --git a/k8s/helm/immich/subcharts/valkey/values.yaml b/k8s/helm/immich/subcharts/valkey/values.yaml index 9bd771e0..32b9c858 100644 --- a/k8s/helm/immich/subcharts/valkey/values.yaml +++ b/k8s/helm/immich/subcharts/valkey/values.yaml @@ -10,6 +10,13 @@ deployment: runAsGroup: 1000 seccompProfile: type: RuntimeDefault + resources: + limits: + cpu: 500m + memory: 1024Mi + requests: + cpu: 50m + memory: 128Mi volumeMounts: - mountPath: /usr/local/etc/valkey/valkey.conf