From f34095e772526bbbd075bd477e0e3c10c7ca2576 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 20 Sep 2026 01:03:00 +1000
Subject: [PATCH] Roll jellyfin-ha to v0.3.3 and drop Service affinity

SSO login fails across replicas with "Invalid or expired state": the SSO
plugin kept OAuth state in-process, so /sso/OID/start and the IdP callback
could land on different pods. v0.3.3 ships the forked plugin backing that
state with Valkey.

- bump cheeztv and fafflix to jellyfin-ha:v0.3.3
- remove sessionAffinity: ClientIP from both Services
---
 apps/base/cheeztv/service.yaml     | 2 --
 apps/base/cheeztv/statefulset.yaml | 2 +-
 apps/base/fafflix/service.yaml     | 2 --
 apps/base/fafflix/statefulset.yaml | 2 +-
 4 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/apps/base/cheeztv/service.yaml b/apps/base/cheeztv/service.yaml
index 625ece9..004fc10 100644
--- a/apps/base/cheeztv/service.yaml
+++ b/apps/base/cheeztv/service.yaml
@@ -13,6 +13,4 @@ spec:
       targetPort: http
   selector:
     app: cheeztv
-  # Pin each client to one replica to reduce transcode-session churn/takeover.
-  sessionAffinity: ClientIP
   type: ClusterIP
diff --git a/apps/base/cheeztv/statefulset.yaml b/apps/base/cheeztv/statefulset.yaml
index f83661f..fe44d62 100644
--- a/apps/base/cheeztv/statefulset.yaml
+++ b/apps/base/cheeztv/statefulset.yaml
@@ -164,7 +164,7 @@ spec:
               readOnly: true
       containers:
         - name: cheeztv
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.3.2
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.3.3
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
diff --git a/apps/base/fafflix/service.yaml b/apps/base/fafflix/service.yaml
index 9f35a56..635fc3f 100644
--- a/apps/base/fafflix/service.yaml
+++ b/apps/base/fafflix/service.yaml
@@ -13,6 +13,4 @@ spec:
       targetPort: http
   selector:
     app: fafflix
-  # Pin each client to one replica to reduce transcode-session churn/takeover.
-  sessionAffinity: ClientIP
   type: ClusterIP
diff --git a/apps/base/fafflix/statefulset.yaml b/apps/base/fafflix/statefulset.yaml
index b9fb761..c6f1c16 100644
--- a/apps/base/fafflix/statefulset.yaml
+++ b/apps/base/fafflix/statefulset.yaml
@@ -164,7 +164,7 @@ spec:
               readOnly: true
       containers:
         - name: fafflix
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.3.2
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.3.3
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
-- 
2.47.3