2026-05-05 - 2026-11-05
Overview
433 Pull requests merged by 3 users
Merged
#574 Require tokens for artifactapi uploads
Merged
#573 Bump artifactapi to v3.25.0
Merged
#572 Bump artifactapi to v3.24.0
Merged
#571 bump artifactapi to v3.23.0
Merged
#570 bump artifactapi to v3.22.0
Merged
#569 bind-resolvers: RBL zones as BindZones
Merged
#568 bump artifactapi to v3.21.0
Merged
#567 Deploy encapi v0.2.0 with Vault OIDC
Merged
#566 Raise puppet-postgres memory
Merged
#565 bump artifactapi to v3.20.0
Merged
#563 bump artifactapi to v3.19.0
Merged
#562 bump artifactapi to v3.18.0
Merged
#561 bump artifactapi to v3.17.1
Merged
#560 bump artifactapi to v3.16.0
Merged
#559 bump artifactapi to v3.15.0
Merged
#558 bind-operator: v0.4.0
Merged
#556 mail: use real edge MTA public IPs
Merged
#557 bind-internal: add mail edge A records
Merged
#555 bind-resolvers: forward to public resolvers, RBLs direct
Merged
#554 Allow the bne dmz vpc in the resolver dmz acl
Merged
#553 bind-resolvers: stop querying IPv6 nameservers
Merged
#552 Enable Vault OIDC auth on artifactapi config writes
Merged
#551 Move resolver DMZ ACL to the RFC 1918 mail VPC ranges
Merged
#548 Verify smarthost edge relays against the internal CA
Merged
#550 Add main.unkin.net as a second mail domain
Merged
#544 Route rspamd-tagged mail to Junk through Stalwart's spam filter
Merged
#545 Allow BinaryLane DMZ VPCs in resolver ACL
Merged
#549 Give stalwart-apply a writable HOME
Merged
#547 Terminate haproxy edge TLS at Traefik
Merged
#539 Deploy Stalwart into the mail namespace
Merged
#546 Recurse from root hints on bind-resolvers
Merged
#542 Add rspamd, ClamAV and sentinel Valkey to the mail namespace
Merged
#541 Add postfix smarthost to the mail namespace
Merged
#543 bind-internal: point mail.unkin.net at 198.18.200.18
Merged
#540 Add internal mail.unkin.net A record
Merged
#538 Add mail namespace with Stalwart backing stores
Merged
#537 Add terraform-binarylane woodpecker service account
Merged
#536 Bump pdbmux to v0.5.0
Merged
#535 add artifactapi image-keeper daemonset
Merged
#534 bump artifactapi to v3.13.1
Merged
#532 pin artifactapi back to v3.12.0
Merged
#529 Bump artifactapi to v3.13.0
Merged
#530 consul: remove standalone k8s consul
Merged
#527 kea: bump to v0.1.7 from docker-internal
Merged
#528 consul: pull chart via artifactapi helm mirror
Merged
#525 logging: expose vlselect on internal traefik
Merged
#526 authentik: raise server cpu request to 500m
Merged
#524 Raise puppetserver compiler requests to match real usage
Merged
#523 feat(bind-internal): publish haproxy edge sites from k8s DNS
Merged
#522 Serve grafana.unkin.net from traefik-external
Merged
#521 Bump artifactapi to v3.12.0
Merged
#520 Set traefik resource requests so HPAs can scale
Merged
#519 Set traefik-external externalTrafficPolicy to Local
Merged
#518 Drop git.unkin.net from k8s gitea gateway and routes
Merged
#517 vmagent: raise kubernetes-apiservers max_scrape_size to 64MiB
Merged
#516 vmagent: fix consul target address relabel
Merged
#515 vmagent: cap consul SD wait time under nginx timeout
Merged
#514 Rename the terraform-infra CI ServiceAccount to terraform-netbox
Merged
#513 Add k8up Grafana dashboard
Merged
#512 Scrape k8up operator metrics
Merged
#511 feat(grafana): sync kubernetes dashboards from victoria-metrics-k8s-stack
Merged
#510 grafana: drop alerting Service and POD_IP env owned by grafana-operator
Merged
#509 grafana: enable unified alerting HA gossip
Merged
#508 grafana: scale to 3 replicas, raise limits
Merged
#507 Give vlogs its own namespace
Merged
#506 Collect pod logs with VLAgent, retire the NATS/ClickHouse chain
Merged
#505 Drop obsolete vector-test CI pipeline
Merged
#503 Promote bind-operator to v0.3.1
Merged
#504 Redirect vlogs root to the VictoriaLogs UI
Merged
#501 Split bind-internal DNSRecords into one file per record
Merged
#500 Split bind-external DNSRecords into one file per record
Merged
#498 Expose VictoriaLogs UI at vlogs.unkin.net behind oauth2-proxy
Merged
#499 Drop the gocache serve Deployment and nginx sidecar
Merged
#488 Add a VictoriaLogs cluster and point logs-ingest at it
Merged
#496 Add gocache serve Deployment with nginx stream sidecar
Merged
#495 Declare the acme.unkin.net nameservers
Merged
#494 Roll bind-operator to v0.3.0
Merged
#493 bump victoria-metrics-operator chart to 0.67.3
Merged
#492 Move the haproxy edge behind the external Traefik
Merged
#491 Drop stalwart mail proxying from the haproxy edge
Merged
#489 Add Ceph RGW bucket for the shared Go build cache
Merged
#490 Add job and start deadlines to the g10k-code CronJob
Merged
#487 Drop dead X-Frame-Options rules from the haproxy edge
Merged
#485 Move the au-syd1 haproxy edge into Kubernetes
Merged
#486 Publish real delegation records for acme.unkin.net
Merged
#484 Add *.main and *.ceph wildcard certificates for haproxy
Merged
#482 Give the puppetserver compilers the Vault cert helpers
Merged
#483 Bump jellyfin-ha to v0.4.0
Merged
#481 Roll jellyfin-ha to v0.3.3 and drop Service session affinity
Merged
#480 Roll bind-operator to v0.2.7 (journal-aware zone seeding)
Merged
#479 Add woodpecker ServiceAccount for jellyfin-plugin-sso CI
Merged
#478 Rewrite slash-less Authentik token endpoint to the canonical path
Merged
#477 Enable PKCE for ArgoCD OIDC login
Merged
#476 Add VMPodScrape for authentik-server metrics
Merged
#475 Enable pg_stat_statements on the authentik postgres cluster
Merged
#474 Raise authentik postgres CPU, memory and buffer sizing
Merged
#473 Enable hot_standby_feedback on the authentik postgres cluster
Merged
#471 Auto-reload cheeztv and fafflix on plugin ConfigMap change
Merged
#470 Point jellyfin SSO at public Authentik hostname
Merged
#468 Pin jellyfin-ha image to v0.3.2
Merged
#467 puppet: install toml into the puppetserver gem path
Merged
#466 Pin pdbmux to v0.4.0
Merged
#465 Revert jellyfin-ha to v0.2.0
Merged
#464 pdbmux: bump image to v0.3.0
Merged
#463 jellyfin: bump fafflix+cheeztv to v0.3.1
Merged
#462 allow catalog-diff to compile catalogs on the puppet compilers
Merged
#461 revert jellyfin-ha to v0.2.0
Merged
#460 bump jellyfin-ha to v0.3.0
Merged
#459 woodpecker: raise agent workspace PVC to 20Gi
Merged
#458 artifactapi: restore combine-certs + PROVIDER_CA_FILES on oauth2-proxy
Merged
#456 Put the artifactapi web UI behind Authentik oauth2-proxy
Merged
#455 pdbmux: bump image to v0.2.0
Merged
#453 Bump artifactapi to v3.11.2
Merged
#452 pdbmux: order backends new-first and drop primary/prefer
Merged
#454 woodpecker: add vimpack-ci ServiceAccount
Merged
#451 puppet: use OPENVOXSERVER_JAVA_ARGS for puppetserver JVM args
Merged
#450 Bump encapi image to v0.1.2
Merged
#449 Set puppetserver environment timeout to 0
Merged
#448 Bump arrproxy images to v0.6.1
Merged
#447 Add golib-ci ServiceAccount for woodpecker
Merged
#446 Bump repospawner to v0.1.1
Merged
#445 Deploy repospawner v0.1.0
Merged
#444 arrproxy: v0.6.0 self-migrating, drop external migrate Job
Merged
#441 mediamark: deploy the media marking app
Merged
#443 arrproxy: bump images to v0.5.0 (per-token method scoping)
Merged
#442 woodpecker: add repospawner-ci ServiceAccount
Merged
#433 logging: use canonical upstream image names
Merged
#437 valkey-operator-system: use canonical ghcr.io registry
Merged
#440 grafana: stop pinning the internal CA for Authentik OAuth
Merged
#439 argocd: drop internal-CA rootCA pin from Authentik oidc.config
Merged
#438 woodpecker: add mediamark-ci service account
Merged
#436 clickhouse-system: use canonical upstream image names
Merged
#435 watchstate: use canonical upstream image name for alpine
Merged
#434 netbox: use canonical upstream image name for redis_exporter
Merged
#432 litellm: use canonical upstream image name for redis_exporter
Merged
#431 gitea: use canonical upstream image name for redis_exporter
Merged
#430 authentik: use canonical upstream image name for redis_exporter
Merged
#429 artifactapi: use canonical upstream image name for redis_exporter
Merged
#428 arrstack,fafflix,cheeztv: provision shared mediastore CephFS volume
Merged
#427 arrstack: use canonical upstream image names
Merged
#424 fafflix,cheeztv: declarative SSO + LDAP plugin auth config
Merged
#426 jellyfin: bump fafflix+cheeztv to v0.2.0
Merged
#425 kea-operator: bump to v0.1.5
Merged
#423 kea-operator: bump to v0.1.4
Merged
#422 authentik: deploy LDAP outpost for in-cluster app-password binds
Merged
#420 watchstate: expose externally at watchstate.unkin.net
Merged
#421 bind-internal: add cheeztv.unkin.net record
Merged
#418 Extend LE *.unkin.net wildcard to arrstack + authentik (reflect into gitea)
Merged
#419 watchstate: deploy admin-gated jellyfin watch-state sync tool
Merged
#417 cheeztv: terminate public cheeztv.unkin.net TLS with the LE *.unkin.net wildcard
Merged
#416 arrstack: wire arrproxy v0.4.0 tier routing (fafflix/cheeztv)
Merged
#415 Replace legacy jellyfin app with fafflix (adult, cheeztv pattern)
Merged
#414 arrstack: rebuild adult tier on the shared-Postgres pattern
Merged
#413 Add cheeztv kids Jellyfin instance + fafflix kids mounts
Merged
#412 arrstack: add kids backend tier (sonarr/radarr/nzbget-kids)
Merged
#411 arrproxy: bump images to v0.3.1
Merged
#410 authentik: ClientIP session affinity on server service
Merged
#379 arrstack: repoint arrproxy oauth2-proxy image off ghcr (fix ImagePullBackOff)
Merged
#409 logging: set clickhouse readonly profile to readonly=2
Merged
#408 arrstack: raise arrstack-postgres resources after OOMKills
Merged
#407 Add Traefik Grafana dashboard
Merged
#406 arrproxy: bump image versions to v0.3.0
Merged
#405 Add logviewer.unkin.net internal DNS record
Merged
#399 observability: fix dropped kubelet/cadvisor metrics, add kube-state-metrics + VMAlert k8s.rules
Merged
#398 Export and scrape metrics from all redis/valkey instances
Merged
#404 logging: deploy logviewer v0.1.0 behind oauth2-proxy
Merged
#403 Bump radarr to v6.4.2-unkin7
Merged
#402 Bump prowlarr to v2.6.2-unkin6
Merged
#400 logging: add read-only clickhouse logreader user + Vault-synced secret
Merged
#401 Bump arrstack image pins: radarr v6.4.2-unkin6, sonarr v5.0.0-unkin6
Merged
#397 Scrape traefik gateway metrics into VictoriaMetrics
Merged
#396 Add Redis/Valkey Grafana dashboard
Merged
#394 Add shared arrstack Valkey and wire arr apps' Redis features
Merged
#395 arrstack: add exportarr metrics sidecars to sonarr and radarr
Merged
#393 Deploy mediamover v0.1.0 into arrstack
Merged
#392 Deploy arrstack S3 TLS-trust fix (arrstack images -unkin4 -> -unkin5)
Merged
#391 Mount mediafs CephFS into arrstack
Merged
#390 arrstack: deploy -unkin4 (Redis SignalR backplane + S3 storage)
Merged
#389 arrstack: S3 buckets + wiring for app backups and sonarr MediaCover
Merged
#388 Deploy arrstack -unkin3 (active-active code)
Merged
#387 arrstack: provision shared Ceph RGW bucket for media assets
Merged
#386 arrstack: use waitfordb initContainer instead of inline psql loop
Merged
#385 arrstack: fix sync-wave deadlock + config multi-attach
Merged
#384 Deploy arrproxy v0.2.0 machine-mint admin route
Merged
#383 arrstack: run sonarr/radarr/prowlarr active-active on shared Postgres
Merged
#382 arrstack: set *arr AuthenticationMethod=External (proxy-trusted)
Merged
#381 arrproxy: allow unverified email in oauth2-proxy (Authentik sets email_verified=false)
Merged
#380 arrproxy: use real quay.io oauth2-proxy address (rke2 mirror)
Merged
#378 arrstack: set *arr UrlBase=/<app> for path-based proxy hosting
Merged
#377 deploy arrproxy (oauth2-gated *arr proxy + per-user API keys)
Merged
#376 woodpecker: add arrproxy-ci service account
Merged
#375 jellyfin: make Valkey HA
Merged
#374 jellyfin: bump image to v0.1.3 (.NET 9 runtime fix)
Merged
#373 jellyfin: bump image to v0.1.2
Merged
#372 ghp: deploy service-token fork image + wire GHP_AUTH_SERVICE_TOKENS
Merged
#371 woodpecker: allow CA-baked docker-buildx plugin as privileged
Merged
#370 arrstack/nzbget: fix nonexistent image tag v26.2 -> version-v26.2
Merged
#369 arrstack: manage sonarr/radarr/prowlarr API keys via Vault
Merged
#368 woodpecker: add plugin-docker-buildx CI ServiceAccount
Merged
#366 arrstack: sonarr/radarr/prowlarr/nzbget on shared CephFS media
Merged
#367 jellyfin: replace redis Deployment with valkey-operator instance
Merged
#237 Deploy jellyfin-ha as a true-HA StatefulSet under a new media project
Merged
#365 Install valkey-operator
Merged
#364 woodpecker: add ghp CI ServiceAccount
Merged
#363 Deploy k8up backup operator (platform, k8up-system)
Merged
#362 woodpecker: add autobackup-operator CI ServiceAccount
Merged
#361 ghp: serve plain HTTP behind the gateway (fix redirect loop)
Merged
#360 ghp: serve at ghp.unkin.net (gateway + cert + httproute + DNS)
Merged
#359 ghp: use direct ghcr.io image + set GHP_ADMINS
Merged
#357 add ghp (GitHub proxy) deployment
Merged
#358 artifactapi: bump image to v3.11.1
Merged
#356 artifactapi: bump image to v3.11.0
Merged
#355 artifactapi: bump image to v3.10.1
Merged
#354 artifactapi: bump images to v3.10.0 (apk repo support + UI)
Merged
#353 artifactapi: bump images to v3.9.1 (deb repo support + UI)
Merged
#352 woodpecker: add jellyfin-ha-src CI ServiceAccount
Merged
#351 Bump artifactapi to v3.8.0
Merged
#349 Force Replace sync for the Recreate puppet master to clear stale rollingUpdate
Merged
#350 Ignore defaulted StatefulSet volumeClaimTemplates TypeMeta
Merged
#347 Fix cert-manager recursive-nameserver ControllerConfiguration field
Merged
#346 Wire API_TOKEN_PEPPERS into NetBox config
Merged
#344 Bump kea images to v0.1.3 (HA peer DNS startup wait)
Merged
#345 traefik-internal: add ldaps :636 entrypoint for authentik LDAPS
Merged
#319 puppet: reduce privilege in namespace workloads (#307)
Merged
#343 Bump kea images to v0.1.2 (socket dir 0750 fix)
Merged
#320 Add Tier-2 per-app Vector transform pipelines (structured logs)
Merged
#342 puppetdb: isolate only the stockpile queue per pod (fix #340 crashloop)
Merged
#340 puppetdb: unique per-pod command-queue directory
Merged
#341 Pin puppet master to a single Recreate replica
Merged
#339 Enable Reloader secret watching, scope existing auto to configmap-only (#326)
Merged
#338 Fix kea CrashLoopBackOff: drop DHCP ntp hostnames, bump to v0.1.1
Merged
#337 Point cert-manager DNS-01 at public recursive nameservers
Merged
#336 artifactapi: serve plain HTTP without HTTPS redirect
Merged
#335 Rename terraform-ipam CI ServiceAccount -> terraform-infra
Merged
#333 Deploy kea DHCP operator to dhcp-system
Merged
#334 Add terraform-ipam CI ServiceAccount
Merged
#332 Add agent-dns RBAC: static SA + ClusterRole + per-namespace RoleBindings
Merged
#331 Add cnameStrategy: Follow to ACME DNS-01 solvers
Merged
#330 Add kea-operator-ci ServiceAccount for Woodpecker CI
Merged
#328 Import live vault-issuer ClusterIssuer into GitOps
Merged
#329 Add bind-external namespace for externally-reachable zones
Merged
#327 Add Let's Encrypt RFC2136/TSIG ClusterIssuers
Merged
#318 Add Tier-1 per-app Vector transform pipelines (structured logs)
Merged
#317 gitea: use git.k8s ROOT_URL for testing
Merged
#310 Pull in-estate service images from artifactapi docker-internal
Merged
#309 Add k8s Gitea deployment (migration target for git.unkin.net)
Merged
#316 cephrgw: recreate cnpg backup buckets on ec placement (step 3)
Merged
#315 cephrgw: remove cnpg backup buckets (ec migration step 2)
Merged
#314 Trust internal CA for Authentik SSO; canonical identity.unkin.net for NetBox
Merged
#313 cephrgw: allow purge-on-delete for cnpg backup buckets
Merged
#312 cephrgw v0.4.0; move CNPG backup buckets to ec placement
Merged
#311 Fix nats-bootstrap: run from /tmp so the nats CLI works under readOnlyRootFS
Merged
#308 Replace vector-archiver with logarchiver
Merged
#306 Fix NATS auth: wrap env-var passwords in << >> so the server expands them
Merged
#301 Fix logging deploy: enable Vector env interpolation; operator watches logging ns
Merged
#305 certificates: restore the validly-signed intermediate in vault-ca-cert
Merged
#304 Use full postgres image on minimal CNPG clusters so WAL archiving works
Merged
#303 Trust internal unkin.net CA for ArgoCD OIDC egress
Merged
#297 Bump Woodpecker CI to v3.16.0
Merged
#296 Add ClickHouse + Vector + NATS JetStream centralized logging (with S3 raw archive)
Merged
#300 authentik: raise CNPG postgres memory to stop replica OOMKills
Merged
#299 Deploy NetBox (CNPG Postgres, Valkey, Authentik SSO)
Merged
#298 Add S3 backups to all CNPG Postgres clusters
Merged
#295 Add PTR to external-dns managed record types
Merged
#294 Fix external-dns PTR flag (--create-ptr)
Merged
#292 Enable PTR synthesis in external-dns
Merged
#293 Roll bind-operator to v0.2.6 (loop-free TSIG-keyed NOTIFY)
Merged
#291 Revert bind-operator to v0.2.4 (v0.2.5 rolling-restart loop)
Merged
#288 Flip resolver forwarding for k8s zones to the in-cluster bind
Merged
#290 Roll cephrgw-operator to v0.3.1 (CRD staleness warning)
Merged
#289 Roll bind-operator to v0.2.5 (intra-cluster NOTIFY fix)
Merged
#287 Repoint external-dns at the in-cluster bind-externaldns primary
Merged
#285 Reflect externaldns TSIG key into the externaldns namespace
Merged
#286 Bump cephrgw-operator CRDs to v0.3.0
Merged
#283 Add advise-mode VPA for every workload
Merged
#281 Add vpa-system: VPA CRDs + recommender (advise mode)
Merged
#282 Route consul API hostname to the HTTP API (8500)
Merged
#284 Add VPA CRDs and kubeconform schemas
Merged
#280 Enable ACLs on k8s consul with Vault-sourced bootstrap token
Merged
#279 Roll cephrgw-operator to v0.3.0 (safe adoption)
Merged
#278 Roll artifactapi to v3.7.7
Merged
#277 Swap puppet compiler ENC to the encapic Go binary
Merged
#272 Switch puppet compiler ENC from Cobbler to encapi
Merged
#275 pdbmux: deploy the merging PuppetDB proxy in-cluster
Merged
#276 Trust internal CA in cephrgw-operator (fix radosgw TLS)
Merged
#274 Add terraform-enc woodpecker ServiceAccount
Merged
#273 Roll cephrgw-operator to v0.2.0 (radosgw-native)
Merged
#268 Wire LiteLLM SSO to Authentik (generic OIDC)
Merged
#271 bind-internal: allow k8s pod network to query the resolvers
Merged
#270 Bump bind-operator to v0.2.4
Merged
#269 TEMP: forward k8s.syd1.au.unkin.net to external external-dns service
Merged
#267 bind-internal: allow localhost to query the authoritative cluster
Merged
#266 bind-internal: add dashboard.ceph.unkin.net + lb1.unkin.net records
Merged
#262 cephrgw-system: source cephrgw-credentials from Vault via VSO
Merged
#265 bind-internal: add s3.ceph.unkin.net CNAME -> radosgw.service.consul
Merged
#264 Wire Grafana OAuth roles to Authentik ak_groups / akP-grafana-admin
Merged
#263 Wire ArgoCD RBAC to Authentik ak_groups / akP-argocd-admin
Merged
#261 Deploy cephrgw-operator to cephrgw-system
Merged
#260 bind-internal: add ceph.unkin.net authoritative zone
Merged
#259 bind-internal: allow admin workstation to query the resolver
Merged
#258 bind-internal: allow admin workstation + router to query authoritative
Merged
#257 Add terraform-rancher woodpecker ServiceAccount
Merged
#256 Add identity.unkin.net internal DNS record
Merged
#255 Bump bind-operator to v0.2.3 (deterministic render)
Merged
#253 Wire ArgoCD to Authentik OIDC
Merged
#254 Bump bind-operator to v0.2.2 (config-hash rolling restart)
Merged
#252 Fix validate-except syntax (resolver crash-loop)
Merged
#251 Exempt internal split-horizon zones from resolver DNSSEC validation
Merged
#250 Bump bind-operator to v0.2.1 (secondary replication fix)
Merged
#249 Bump bind-operator to v0.2.0 and deploy companion TSIG API
Merged
#248 reduce CPU requests across observability, authentik, bind, woodpecker
Merged
#247 cnpg: reduce cluster CPU requests to 50m
Merged
#245 chore: remove paperclip
Merged
#246 chore: reduce resource requirements of puppet
Merged
#244 Authoritative zones: accept puppet client dynamic updates
Merged
#243 grafana: add CloudNativePG dashboard (follow-up to #239)
Merged
#242 observability: scrape CloudNativePG postgres metrics (follow-up to #239)
Merged
#241 cert-manager: scrape metrics (follow-up to #239)
Merged
#240 vmagent: set consul datacenter (fix 0 discovered targets)
Merged
#239 observability: scrape existing app metrics (audit + ceph-csi batch)
Merged
#238 grafana: deploy Grafana instance, datasource and dashboards
Merged
#236 schemas: add grafana.integreatly.org CRD schemas
Merged
#235 grafana-system: deploy grafana-operator
Merged
#234 observability: migrate VictoriaMetrics to operator CRDs + Consul SD
Merged
#233 chore: add encapi to platform project
Merged
#232 bump artifactapi to 3.7.6
Merged
#230 deploy encapi to au-syd1
Merged
#231 chore: bump artifactapi to v3.7.5
Merged
#229 Add primary (write) Services to authoritative + externaldns
Merged
#228 Use externalTrafficPolicy: Local on the DNS services
Merged
#227 Restrict authoritative queries to internal networks
Merged
#226 Configure resolvers like puppet (openforwarder view + forward zones)
Merged
#225 Consolidate BIND DNS into one bind-internal namespace
Merged
#222 Deploy binddns-externaldns (RFC2136 dynamic cluster)
Merged
#221 Deploy binddns-resolver (recursive resolver cluster)
Merged
#224 Bump bind-operator image to v0.1.2
Merged
#220 Deploy binddns-auth (authoritative BIND cluster)
Merged
#223 Rename bind DNS namespaces to ns-*
Merged
#219 Deploy bind-operator (operator + CRDs)
Merged
#218 chore(artifactapi): deploy v3.7.4
Merged
#215 chore(artifactapi): deploy v3.7.3
Merged
#214 feat: add woodpecker service accounts for media terraform repos
Merged
#213 fix: update TLSRoute to v1
Merged
#211 Add Authentik identity provider deployment
Merged
#212 Add JSON schema generation for kubeconform CRD validation
Merged
#210 Add age-api deployment
Merged
#209 chore: source schema source for kubeconform
Merged
#208 chore: bump artifactapi + ui to v3.6.5
Merged
#207 chore: bump artifactapi + ui to v3.6.4
Merged
#206 chore: bump artifactapi + ui to v3.6.3
Merged
#205 chore: bump artifactapi + ui to v3.6.2
Merged
#204 chore: bump artifactapi + ui to v3.6.1
Merged
#203 chore: bump artifactapi + ui to v3.6.0
Merged
#202 fix: update UI health check paths to /ui
Merged
#201 refactor: simplify artifactapi routes
Merged
#200 fix: route /v2 and /health to artifactapi API service
Merged
#199 fix: rename environment2 to environment
Merged
#198 feat: artifactapi route change
Merged
#197 feat: migrate to artifactapi 3+
Merged
#196 chore: cleanup artifactory3 mess
Merged
#195 🤦
Merged
#194 feat: manage postgres-credentials for artifactapi3
Merged
#193 chore: remove middleware resource
Merged
#192 feat: deploy artifactapi3
Merged
#191 fix: update woodpecker kustomization
Merged
#190 feat: enable terraform-artifactapi jobs
Merged
#189 feat: add terraform-git service account for woodpecker CI
Merged
#188 chore: bump almalinux9 image tags
Merged
#187 benvin/gitea
Merged
#186 chore: add almalinux-vault repos
Merged
#185 feat(kanidm): scale down to single replica, remove replication
Merged
#184 feat: add sessionaffinity to kanidm service
Merged
#182 fix(kanidm): fix automatic_refresh TOML generation in init container
Merged
#181 fix(kanidm): replicate 1/2 from 0 only with automatic_refresh
Merged
#180 feat: autorestart statefulset
Merged
#179 fix(kanidm): remove invalid automatic_refresh from replication config
Merged
#177 Update apps/base/kanidm/vaultauth.yaml
Merged
#176 feat(kanidm): vault-managed replication certs with auto-restart
Merged
#175 feat(woodpecker): set workflow pod priority class to power
Merged
#174 feat(platform): add priority-classes app with low/power/medium/high classes
Merged
#173 feat(artifactapi): add open-webui/open-webui to ghcr immutable patterns
Merged
#171 feat(vault): switch to Kubernetes service registration
Merged
#170 chore: update replication certs
Merged
#169 feat: update kanidm replicaiton
Merged
#168 feat(artifactapi): add conftest to GitHub generic remote cache
Merged
#166 fix(puppet): remove explicit clusterIP: null from puppetdb Service
Merged
#165 fix(kanidm): add explicit group/kind/weight to TLSRoute refs
Merged
#164 fix(consul): normalize cpu limit to canonical string form
Merged
#163 fix(litellm): normalize postgres cluster resource values
Merged
#162 fix(gateways): add explicit group/kind/weight to all HTTPRoute refs
Merged
#161 fix(kanidm): use dockerhub image instead of ghcr.io
Merged
#160 fix(artifactapi): move kanidm to dockerhub remote
Merged
#159 benvin/kanidm
Merged
#158 benvin/artifactapi-mail-images
Merged
#157 feat(artifactapi): cache stalwart webadmin zip
Merged
#156 feat(artifactapi): add mail stack images to docker registry cache
Merged
#153 fix(gateways): add explicit group: "" to all certificateRefs entries
Merged
#152 fix(argocd): add vault and consul to platform project destinations
Merged
#151 feat(artifactapi): add kanidm to ghcr docker immutable patterns
Merged
#149 feat(consul): deploy HashiCorp Consul 1.22.7 via Helm chart (5-replica cluster)
Merged
#148 feat(vault): deploy HashiCorp Vault 2.0.1 via Helm chart (5-replica HA raft)
Merged
#150 feat(cert-manager): upgrade to v1.20.2 and enable Gateway API support
Merged
#147 feat(artifactapi): add hashicorp/consul and hashicorp/vault to docker immutable patterns
Merged
#146 feat(woodpecker): upgrade to v3.14.1 (chart 3.6.3)
Merged
#144 feat: increase litellm resources
Merged
#145 feat: add HTTP→HTTPS redirect to Gateway API services
Merged
#129 feat(artifactapi): migrate Ingress to Gateway API
Merged
#131 feat(puppet): migrate puppetdb Ingress to Gateway API
Merged
#130 feat(puppet): migrate puppetboard Ingress to Gateway API
Merged
#133 feat(paperclip): migrate Ingress to Gateway API
Merged
#134 feat(litellm): migrate Ingress to Gateway API
Merged
#143 feat(externaldns): upgrade to 1.21.1, fix sources for installed CRDs
Merged
#142 benvin/externaldns_compatability
Merged
#140 temp: enable debug logging on externaldns to diagnose TLSRoute sync timeout
Merged
#138 fix(traefik): listen on port 443 directly for Gateway API compatibility
Merged
#132 feat(cattle-system): migrate rancher Ingress to Gateway API
Merged
#137 fix(traefik): add instance labels to GatewayClasses
Merged
#136 fix(traefik): remove invalid controllerName flag causing CrashLoopBackOff
Merged
#135 fix(traefik): set controllerName on GatewayClasses and Traefik providers
Merged
#128 fix: terraform_vault must be RFC1123 compliant
Merged
#127 feat: add terraform_vault role
Merged
#126 feat(externaldns): add Gateway API sources for httproute, tlsroute, grpcroute, tcproute, udproute
Merged
#125 fix(traefik): replace invalid controllername flag with labelSelector for v3
Merged
#124 fix: enable gateway/ingress class on platform project
Merged
#119 feat: deploy internal/external traefik routers
Merged
#123 feat(artifactapi): allow kubeconform and kustomize from GitHub
Merged
#122 feat(artifactapi): allow kubecolor releases from GitHub
Merged
#121 feat(artifactapi): allow almalinux, debian, and fedora from Docker Hub
Merged
#120 feat(artifactapi): add argo-helm as a remote and virtual helm member
Merged
#118 feat: change argocd crds source to artifactapi
Merged
#117 feat: deploy gatewayapi crds
Merged
#116 feat: add traefik/gatewayapi
Merged
#115 chore: migrate reloader/reflector to virtual/helm
7 Pull requests proposed by 2 users
Proposed
#167 feat(opa): add conftest OPA policies and pre-commit hook
Proposed
#172 feat(open-webui): deploy Open WebUI with litellm backend
Proposed
#472 Pin helm capabilities version to the validation target
Proposed
#502 Drop the redundant acme.unkin.net apex NS DNSRecord
Proposed
#531 consul: add k8s servers joining the au-syd1 VM datacenter
Proposed
#533 forward consul zone to k8s consul DNS LB
Proposed
#564 Add public main.unkin.net and edge.unkin.net zones to bind-external
2 Issues closed from 1 user
Closed
#307 security: reduce privilege in puppet namespace workloads (root init containers, redundant caps, APE)
Closed
#326 CA-rotation runbook for internal PKI rotation
9 Issues created by 1 user
Opened
#154 feat(immich): deploy Immich photo server with S3 storage and traefik-external gateway
Opened
#155 feat(open-webui): deploy Open WebUI using litellm for model interaction
Opened
#307 security: reduce privilege in puppet namespace workloads (root init containers, redundant caps, APE)
Opened
#322 geoip enrichment for nginx/traefik Vector access-log pipelines
Opened
#321 Gitea git.unkin.net production cutover (VM forge -> k8s)
Opened
#324 Finish the DNS migration off the Puppet zone to in-cluster bind
Opened
#325 Woodpecker k8s runner: trust the internal CA so buildx can push to artifactapi
Opened
#323 Decommission the legacy standalone ceph-csi namespace
Opened
#326 CA-rotation runbook for internal PKI rotation