instantlinux · instantlinux · Sep 1, 2026 · Sep 1, 2026
diff --git a/ansible/roles/docker_node/defaults/main.yml b/ansible/roles/docker_node/defaults/main.yml
@@ -5,7 +5,7 @@ docker_defaults:
   apt_repo:
     key: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88
     package_name: docker-ce
-    package_ver: 5:29.6.1-1~ubuntu.26.04~resolute
+    package_ver: 5:29.7.2-1~ubuntu.26.04~resolute
     repo: deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu {{ ansible_facts['distribution_release'] }} stable
     url: https://download.docker.com/linux/ubuntu/gpg
   certs:

diff --git a/ansible/roles/kubernetes/defaults/main.yml b/ansible/roles/kubernetes/defaults/main.yml
@@ -13,9 +13,9 @@ k8s_defaults:
   admin_config: /etc/kubernetes/admin.conf
   config_fetch_always: false
   apt_repo:
-    # TODO parameterize hardcoded 1.35 value
-    repo: deb [signed-by=/etc/apt/keyrings/kubernetes.asc] https://pkgs.k8s.io/core:/stable:/v1.35/deb/ /
-    url: https://pkgs.k8s.io/core:/stable:/v1.35/deb/Release.key
+    # TODO parameterize hardcoded 1.36 value
+    repo: deb [signed-by=/etc/apt/keyrings/kubernetes.asc] https://pkgs.k8s.io/core:/stable:/v1.36/deb/ /
+    url: https://pkgs.k8s.io/core:/stable:/v1.36/deb/Release.key
   cplane_hostip: "{{ hostvars[groups['k8s_cplane'][0]]['ansible_default_ipv4']['address'] | default(groups['k8s_cplane'][0]) }}"
   cplane_vip: "{{ hostvars[groups['k8s_cplane'][0]]['ansible_default_ipv4']['address'] | default(groups['k8s_cplane'][0]) }}"
   # TODO: might be able to retire cri-dockerd
@@ -31,9 +31,9 @@ k8s_defaults:
     name: kubelet
     state: restarted
   service_network: 10.96.0.0/12
-  version: 1.35.4
-  coredns_version: v1.13.1
-  cni_version: 1.8.0
+  version: 1.36.4
+  coredns_version: v1.14.2
+  cni_version: 1.9.1
 k8s_override: {}
 k8s: "{{ k8s_defaults | combine(k8s_override) }}"
 

diff --git a/ansible/roles/kubernetes/templates/kubeadm-config-cplane.j2 b/ansible/roles/kubernetes/templates/kubeadm-config-cplane.j2
@@ -0,0 +1,97 @@
+---
+{{ ansible_managed | comment }}
+apiVersion: kubeadm.k8s.io/v1beta4
+kind: InitConfiguration
+bootstrapTokens:
+- token: {{ vault_k8s.join_token }}
+  ttl: 1h0m0s
+  usages:
+  - signing
+  - authentication
+  groups:
+  - system:bootstrappers:kubeadm:default-node-token
+localAPIEndpoint:
+  advertiseAddress: {{ k8s.cplane_hostip }}
+  bindPort: 6443
+nodeRegistration:
+  criSocket: {{ k8s.cri_socket }}
+  imagePullPolicy: IfNotPresent
+  imagePullSerial: true
+  name: {{ ansible_fqdn }}
+  taints:
+  - effect: NoSchedule
+    key: node-role.kubernetes.io/control-plane
+
+# Some default values, uncomment and modify as desired
+# timeouts:
+#   controlPlaneComponentHealthCheck: 4m0s
+#   discovery: 5m0s
+#   etcdAPICall: 2m0s
+#   kubeletHealthCheck: 4m0s
+#   kubernetesAPICall: 1m0s
+#   tlsBootstrap: 5m0s
+#   upgradeManifests: 5m0s
+---
+apiVersion: kubeadm.k8s.io/v1beta4
+kind: ClusterConfiguration
+apiServer:
+  certSANs:
+  - {{ k8s.cplane_hostip }}
+  - {{ k8s.cplane_vip }}
+  extraArgs:
+  - name: encryption-provider-config
+    value: /etc/kubernetes/local/api-crypt.conf
+  - name: oidc-issuer-url
+    value: {{ oidc.issuer_url }}
+  - name: oidc-client-id
+    value: {{ oidc.client_id }}
+  - name: oidc-username-claim
+    value: {{ oidc.username_claim }}
+  - name: oidc-groups-claim
+    value: {{ oidc.groups_claim }}
+  - name: oidc-username-prefix
+    value: {{ oidc.username_prefix }}
+  - name: oidc-groups-prefix
+    value: {{ oidc.group_prefix }}
+  - name: oidc-ca-file
+    value: {{ oidc.ca_file }}
+  extraVolumes:
+  - name: local-config
+    hostPath: "/etc/kubernetes/local"
+    mountPath: "/etc/kubernetes/local"
+    readOnly: true
+    pathType: DirectoryOrCreate
+featureGates:
+  # TODO remove when https works for kubectl exec
+  ExtendWebSocketsToKubelet: false
+controlPlaneEndpoint: "{{ k8s.cplane_vip }}:6443"
+dns:
+  # Workaround for bug 112131; never got fixed as of k8s 1.31:
+  # https://github.com/kubernetes/kubernetes/issues/112131
+  imageRepository: registry.k8s.io/coredns
+  imageTag: {{ k8s.coredns_version }}
+imageRepository: registry.k8s.io
+kubernetesVersion: v{{ k8s.version }}
+networking:
+  dnsDomain: cluster.local
+  podSubnet: {{ k8s.pod_network }}
+  serviceSubnet: {{ k8s.service_network }}
+
+# Some default values, uncomment and modify as desired
+# caCertificateValidityPeriod: 87600h0m0s
+# certificateValidityPeriod: 8760h0m0s
+# certificatesDir: /etc/kubernetes/pki
+# clusterName: kubernetes
+# controllerManager: {}
+# encryptionAlgorithm: RSA-2048
+# etcd:
+#   local:
+#     dataDir: /var/lib/etcd
+---
+apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+containerLogMaxFiles: 3
+containerLogMaxSize: 50Mi
+featureGates:
+  # TODO remove when https works for kubectl exec
+  ExtendWebSocketsToKubelet: false
diff --git a/images/dhcpd-dns-pxe/Dockerfile b/images/dhcpd-dns-pxe/Dockerfile
@@ -9,7 +9,7 @@ LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
     org.label-schema.vcs-ref=$VCS_REF \
     org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools
 ARG KEA_VERSION=3.0.3-r0
-ARG DNSMASQ_VERSION=2.92_p2-r0
+ARG DNSMASQ_VERSION=2.93-r0
 
 ENV DB_HOST=db00 \
     DB_NAME=kea \
@@ -39,7 +39,9 @@ ENV DB_HOST=db00 \
     TFTP_SERVER=self \
     TZ=UTC
 
-RUN apk add --no-cache --update kea=$KEA_VERSION dnsmasq=$DNSMASQ_VERSION \
+RUN echo "@edge https://dl-cdn.alpinelinux.org/alpine/edge/main" \
+      >> /etc/apk/repositories && \
+    apk add --no-cache --update kea=$KEA_VERSION dnsmasq@edge=$DNSMASQ_VERSION \
       kea-admin kea-hook-mysql mariadb-client && \
     mkdir -m 755 /run/kea && chown kea /run/kea
 

diff --git a/images/dhcpd-dns-pxe/helm/Chart.yaml b/images/dhcpd-dns-pxe/helm/Chart.yaml
@@ -8,7 +8,7 @@ sources:
 - http://thekelleys.org.uk/gitweb/?p=dnsmasq.git
 type: application
 version: 0.2.3
-appVersion: "3.0.3-r0-2.92_p2-r0"
+appVersion: "3.0.3-r0-2.93-r0"
 dependencies:
 - name: chartlib
   version: 0.1.8

diff --git a/images/dovecot/Dockerfile b/images/dovecot/Dockerfile
@@ -9,7 +9,7 @@ LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
     org.label-schema.vcs-ref=$VCS_REF \
     org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools
 
-ARG DOVECOT_VERSION=2.4.4-r0
+ARG DOVECOT_VERSION=2.4.5-r0
 ARG PROCMAIL_VERSION=3.22-r4
 ARG MKCERT_SHA=d1efad065f9ef34da372847ff4a4d5ffd86b97410b303d8a43ea25aa2119c86d
 ARG PROCMAIL_SHA=4ac9f21c3d7dbed5b32e7547da39f4d429de480679b4c856026caea39ca842f9
@@ -30,7 +30,9 @@ RUN cd /tmp && \
       wget -q https://dl-cdn.alpinelinux.org/alpine/v3.11/main/armv7/procmail-$PROCMAIL_VERSION.apk ;; \
     *) echo Unrecognized ${TARGETPLATFORM} ;; \
     esac && \
-    apk add --no-cache dovecot=$DOVECOT_VERSION dovecot-ldap=$DOVECOT_VERSION && \
+    echo "@edge https://dl-cdn.alpinelinux.org/alpine/edge/main" \
+      >> /etc/apk/repositories && \
+    apk add --no-cache dovecot@edge=$DOVECOT_VERSION dovecot-ldap@edge=$DOVECOT_VERSION && \
     apk add --allow-untrusted procmail-$PROCMAIL_VERSION.apk && \
     cd /usr/local/bin && \
     wget -q https://raw.githubusercontent.com/dovecot/core/release-2.4.1/doc/mkcert.sh && \

diff --git a/images/dovecot/helm/Chart.yaml b/images/dovecot/helm/Chart.yaml
@@ -6,8 +6,8 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/vdukhovni/dovecot
 type: application
-version: 0.1.16
-appVersion: "2.4.4-r0"
+version: 0.1.17
+appVersion: "2.4.5-r0"
 dependencies:
 - name: chartlib
   version: 0.1.8

diff --git a/images/haproxy-keepalived/Dockerfile b/images/haproxy-keepalived/Dockerfile
@@ -1,4 +1,4 @@
-FROM haproxy:3.3.11-alpine
+FROM haproxy:3.4.4-alpine
 ARG BUILD_DATE
 ARG VCS_REF
 LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \

diff --git a/images/haproxy-keepalived/helm/Chart.yaml b/images/haproxy-keepalived/helm/Chart.yaml
@@ -7,9 +7,8 @@ sources:
 - https://github.com/haproxy/haproxy
 - https://github.com/acassen/keepalived
 type: application
-version: 0.1.23
-appVersion: "3.3.11-alpine-2.3.4-r2"
-#appVersion: "3.3.10-alpine-2.3.4-r3"
+version: 0.1.24
+appVersion: "3.4.4-alpine-2.3.4-r2"
 dependencies:
 - name: chartlib
   version: 0.1.8

diff --git a/images/nagios/Dockerfile b/images/nagios/Dockerfile
@@ -8,17 +8,17 @@ LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
     org.label-schema.vcs-ref=$VCS_REF \
     org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools
 
-ARG NAGIOS_VERSION=4.5.13-r0
+ARG NAGIOS_VERSION=4.5.14-r0
 ARG NAGIOS_GID=1000
 ARG NAGIOS_UID=999
 ARG PLUGINS_VERSION=2.5-r0
 ARG WWW_UID=33
 ENV AUTHORIZED_USERS=nagiosadmin \
     CONFIG_CHECK=yes \
-    HTPASSWD_SECRET=nagios-htpasswd \
-    MAIL_AUTH_USER= \
-    MAIL_AUTH_SECRET=nagios-mail-secret \
+    HTPASSWD_SECRETNAME=nagios-htpasswd \
     MAIL_RELAY_HOST=smtp:25 \
+    MAIL_RELAY_SECRETNAME=nagios-mail-secret \
+    MAIL_RELAY_USER= \
     MAIL_USE_TLS=yes \
     NAGIOS_FQDN=nagios.docker \
     NGINX_PORT=80 \
@@ -29,7 +29,9 @@ RUN addgroup -g $NAGIOS_GID nagios && \
     adduser -g www-data -u $WWW_UID -DSH -h /var/www www-data && \
     adduser -G nagios -g "Nagios Server" -DSH -h /var/nagios -u $NAGIOS_UID \
       nagios && \
-    apk add --update --no-cache nagios=$NAGIOS_VERSION nagios-web \
+    echo "@edge https://dl-cdn.alpinelinux.org/alpine/edge/main" \
+      >> /etc/apk/repositories && \
+    apk add --update --no-cache nagios@edge=$NAGIOS_VERSION nagios-web \
       nagios-plugins-all=$PLUGINS_VERSION \
       nagios-plugins-mysql=$PLUGINS_VERSION \
       nrpe-plugin bash curl fcgiwrap file mariadb-client nginx openssl \
@@ -51,4 +53,4 @@ VOLUME /etc/nagios /opt/nagios/plugins /var/nagios
 COPY nginx.conf /etc/nginx/http.d/nagios.conf
 COPY php-fpm-www.conf /etc/php83/php-fpm.d/www.conf
 COPY entrypoint.sh mail.sh /usr/local/bin/
-ENTRYPOINT /usr/local/bin/entrypoint.sh
+ENTRYPOINT [ "/usr/local/bin/entrypoint.sh" ]
diff --git a/images/nagios/README.md b/images/nagios/README.md
@@ -41,10 +41,10 @@ Variable | Default | Description |
 ADMIN_PATH | /opt | Path on localhost (for adding local plugins, etc)
 AUTHORIZED_USERS | nagiosadmin | List of users
 CONFIG_CHECK | yes | Whether to halt on startup if config-check fails
-HTPASSWD_SECRET | nagios-htpasswd | Secret holding basic-auth user/passwords
-MAIL_AUTH_USER | | Auth for SMTP relay provider
-MAIL_AUTH_SECRET | nagios-mail-secret | Name of secret containing mail password
+HTPASSWD_SECRETNAME | nagios-htpasswd | Secret holding basic-auth user/passwords
 MAIL_RELAY_HOST | smtp:25 | FQDN and port of SMTP relay
+MAIL_RELAY_SECRETNAME | nagios-mail-secret | Name of secret containing mail password
+MAIL_RELAY_USER | | Auth for SMTP relay provider
 MAIL_USE_TLS | yes | Whether to encrypt with TLS and STARTTLS
 NAGIOS_MAIL_RELAY | smtp | DNS name for nagios email sending
 NAGIOS_FQDN | nagios.docker | server_name for nginx

diff --git a/images/nut-upsd/Dockerfile b/images/nut-upsd/Dockerfile
@@ -8,7 +8,7 @@ LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
     org.label-schema.name=nut-upsd \
     org.label-schema.vcs-ref=$VCS_REF \
     org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools
-ARG NUT_VERSION=2.8.3-r4
+ARG NUT_VERSION=2.8.5-r1
 ENV ACTIONS= \
     API_USER=upsmon \
     API_PASSWORD= \
@@ -35,8 +35,10 @@ ENV ACTIONS= \
 HEALTHCHECK CMD upsc $NAME@localhost:3493 2>&1|grep -q stale && \
     killall -TERM upsmon || true
 
-RUN apk add --no-cache dash && \
-    apk add --update --no-cache nut=$NUT_VERSION \
+RUN echo "@edge https://dl-cdn.alpinelinux.org/alpine/edge/community" \
+      >> /etc/apk/repositories && \
+    apk add --no-cache dash && \
+    apk add --update --no-cache nut@edge=$NUT_VERSION \
       busybox curl linux-pam libcrypto3 libexpat libssl3 libusb musl \
       net-snmp-libs util-linux musl-utils nghttp2-libs
 

diff --git a/images/nut-upsd/helm/Chart.yaml b/images/nut-upsd/helm/Chart.yaml
@@ -6,8 +6,8 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/networkupstools/nut
 type: application
-version: 0.1.12
-appVersion: "2.8.3-r4"
+version: 0.1.13
+appVersion: "2.8.5-r1"
 dependencies:
 - name: chartlib
   version: 0.1.8

diff --git a/images/openldap/Dockerfile b/images/openldap/Dockerfile
@@ -9,7 +9,7 @@ LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
     org.label-schema.vcs-ref=$VCS_REF \
     org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools
 
-ARG OPENLDAP_VERSION=2.6.13-r0
+ARG OPENLDAP_VERSION=2.6.14-r0
 ENV SLAPD_DN_ATTR=uid \
     SLAPD_FQDN=example.com \
     SLAPD_LOG_LEVEL=Config,Stats \

diff --git a/images/openldap/helm/Chart.yaml b/images/openldap/helm/Chart.yaml
@@ -6,8 +6,8 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://git.openldap.org/openldap/openldap
 type: application
-version: 0.1.9
-appVersion: "2.6.13-r0"
+version: 0.1.10
+appVersion: "2.6.14-r0"
 dependencies:
 - name: chartlib
   version: 0.1.8

diff --git a/images/postfix-python/Dockerfile b/images/postfix-python/Dockerfile
@@ -1,4 +1,4 @@
-ARG POSTFIX_VERSION=3.11.5-r0
+ARG POSTFIX_VERSION=3.11.6-r0
 
 FROM instantlinux/postfix:$POSTFIX_VERSION
 ARG BUILD_DATE

diff --git a/images/postfix-python/helm/Chart.yaml b/images/postfix-python/helm/Chart.yaml
@@ -6,8 +6,8 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/vdukhovni/postfix
 type: application
-version: 0.1.24
-appVersion: "3.11.5-r0"
+version: 0.1.25
+appVersion: "3.11.6-r0"
 dependencies:
 - name: chartlib
   version: 0.1.8

diff --git a/images/postfix/Dockerfile b/images/postfix/Dockerfile
@@ -8,7 +8,7 @@ LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
     org.label-schema.name=postfix \
     org.label-schema.vcs-ref=$VCS_REF \
     org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools
-ARG POSTFIX_VERSION=3.11.5-r0
+ARG POSTFIX_VERSION=3.11.6-r0
 ENV SASL_SECRETNAME=postfix-sasl-passwd \
     TZ=UTC
 

diff --git a/k8s/helm/immich/Chart.yaml b/k8s/helm/immich/Chart.yaml
@@ -6,7 +6,7 @@ sources:
 - https://github.com/immich-app/immich
 - https://github.com/instantlinux/docker-tools
 type: application
-version: 0.1.1
+version: 0.1.2
 # Reminder, update tag for ml instance in values.yaml
 appVersion: v3.0.1
 dependencies:
@@ -20,5 +20,5 @@ dependencies:
   version: 0.1.0
   repository: file://subcharts/postgres
 - name: valkey
-  version: 0.1.0
+  version: 0.1.1
   repository: file://subcharts/valkey
diff --git a/k8s/helm/immich/subcharts/valkey/Chart.yaml b/k8s/helm/immich/subcharts/valkey/Chart.yaml
@@ -6,7 +6,7 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://hub.docker.com/r/valkey/valkey
 type: application
-version: 0.1.0
+version: 0.1.1
 appVersion: "9.1.0-alpine"
 dependencies:
 - name: chartlib

diff --git a/k8s/helm/immich/subcharts/valkey/values.yaml b/k8s/helm/immich/subcharts/valkey/values.yaml
@@ -10,6 +10,13 @@ deployment:
     runAsGroup: 1000
     seccompProfile:
       type: RuntimeDefault
+  resources:
+    limits:
+      cpu: 500m
+      memory: 1024Mi
+    requests:
+      cpu: 50m
+      memory: 128Mi
 
 volumeMounts:
 - mountPath: /usr/local/etc/valkey/valkey.conf