unkin-agent a4efca8ee5 Require tokens for artifactapi uploads (#574) ...

Woodpecker uploaders now mint Vault OIDC tokens, so anonymous local-repo writes can be rejected.

- set `ARTIFACTAPI_AUTH_UPLOADS: "true"` in the artifactapi `api-env` configmap

Merge after unkin/vault-plugin-secrets-litellm#6.

Reviewed-on: #574
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

2026-10-26 20:33:29 +11:00

..

age-api

Enable Reloader secret watching, scope existing auto to configmap-only (#326) (#339)

2026-08-08 19:35:31 +10:00

arrstack

Bump arrproxy images to v0.6.1 (#448)

2026-09-05 11:15:47 +10:00

artifactapi

Require tokens for artifactapi uploads (#574)

2026-10-26 20:33:29 +11:00

authentik

Rewrite slash-less Authentik token endpoint to the canonical path (#478)

2026-09-19 16:10:30 +10:00

bind-external

Split bind-external DNSRecords into one file per record (#500)

2026-09-27 17:28:37 +10:00

bind-internal

bind-resolvers: RBL zones as BindZones (#569)

2026-10-24 17:06:09 +11:00

bind-system

bind-operator: v0.4.0 (#558)

2026-10-17 15:33:16 +11:00

cattle-system

fix(gateways): add explicit group/kind/weight to all HTTPRoute refs (#162)

2026-05-24 20:32:37 +10:00

cephrgw-system

Enable Reloader secret watching, scope existing auto to configmap-only (#326) (#339)

2026-08-08 19:35:31 +10:00

cert-manager

Deploy Stalwart into the mail namespace (#539)

2026-10-13 20:58:08 +11:00

certificates

certificates: restore the validly-signed intermediate in vault-ca-cert (#305)

2026-07-28 23:14:14 +10:00

cheeztv

Bump jellyfin-ha to v0.4.0 (#483)

2026-09-22 22:57:06 +10:00

cnpg-system

feat: migrate cnpg-system from Terraform to ArgoCD (#44)

2026-03-19 01:25:50 +11:00

consul

Route consul API hostname to the HTTP API (8500) (#282)

2026-07-25 18:19:38 +10:00

csi-cephfs

Mount mediafs CephFS into arrstack (#391)

2026-08-22 23:05:43 +10:00

csi-cephrbd

observability: scrape existing app metrics (audit + ceph-csi batch) (#239)

2026-07-06 23:57:54 +10:00

dhcp-system

kea: bump to v0.1.7 from docker-internal (#527)

2026-10-09 21:49:33 +11:00

elastic-system

feat: migrate elastic-system to ArgoCD (#79)

2026-03-27 17:00:05 +11:00

encapi

Deploy encapi v0.2.0 with Vault OIDC (#567)

2026-10-23 23:02:00 +11:00

externaldns

Add agent-dns RBAC: static SA + ClusterRole + per-namespace RoleBindings (#332)

2026-08-02 21:49:37 +10:00

fafflix

Bump jellyfin-ha to v0.4.0 (#483)

2026-09-22 22:57:06 +10:00

ghp

ghp: deploy service-token fork image + wire GHP_AUTH_SERVICE_TOKENS (#372)

2026-08-15 18:18:22 +10:00

gitea

Drop git.unkin.net from k8s gitea gateway and routes (#518)

2026-10-04 15:07:08 +11:00

grafana

Serve grafana.unkin.net from traefik-external (#522)

2026-10-05 00:38:21 +11:00

grafana-system

grafana-system: deploy grafana-operator

2026-07-05 22:16:30 +10:00

haproxy

Terminate haproxy edge TLS at Traefik (#547)

2026-10-13 21:12:40 +11:00

inteldeviceplugins-system

chore: migrate reloader/reflector to virtual/helm (#115)

2026-05-05 21:42:23 +10:00

k8up-system

Scrape k8up operator metrics (#512)

2026-10-02 23:28:59 +10:00

kanidm

Enable Reloader secret watching, scope existing auto to configmap-only (#326) (#339)

2026-08-08 19:35:31 +10:00

litellm

litellm: use canonical upstream image name for redis_exporter (#432)

2026-08-29 21:19:01 +10:00

logging

logging: expose vlselect on internal traefik (#525)

2026-10-05 14:08:33 +11:00

mail

mail: use real edge MTA public IPs (#556)

2026-10-17 12:51:26 +11:00

mediamark

mediamark: deploy the media marking app (#441)

2026-08-30 15:07:41 +10:00

netbox

netbox: use canonical upstream image name for redis_exporter (#434)

2026-08-29 21:19:27 +10:00

node-feature-discovery

feat: migrate node-feature-discovery and inteldeviceplugins-system to platform project (#48)

2026-03-19 02:14:45 +11:00

observability

vmagent: raise kubernetes-apiservers max_scrape_size to 64MiB (#517)

2026-10-04 14:01:14 +11:00

paperclip

cephrgw: recreate cnpg backup buckets on ec placement (step 3) (#316)

2026-07-30 23:44:50 +10:00

pdbmux

Bump pdbmux to v0.5.0 (#536)

2026-10-10 14:39:01 +11:00

priority-classes

feat(platform): add priority-classes app with low/power/medium/high classes (#174)

2026-05-26 23:41:54 +10:00

puppet

Raise puppet-postgres memory (#566)

2026-10-23 21:25:31 +11:00

purelb

feat: migrate purelb to ArgoCD (#84)

2026-04-07 19:52:17 +10:00

reflector-system

fix: helm-charts in overlay only (#5)

2026-03-01 16:01:32 +11:00

reloader-system

feat: add reloader (#6)

2026-03-01 16:34:01 +11:00

repospawner

Bump repospawner to v0.1.1 (#446)

2026-08-30 17:07:58 +10:00

reposync

feat: migrate reposync to ArgoCD (#78)

2026-03-27 16:26:35 +11:00

traefik-system

fix(traefik): add instance labels to GatewayClasses (#137)

2026-05-23 00:23:18 +10:00

valkey-operator-system

Install valkey-operator (#365)

2026-08-15 12:32:57 +10:00

vault

feat(vault): switch to Kubernetes service registration (#171)

2026-05-26 00:06:56 +10:00

vlogs

Give vlogs its own namespace (#507)

2026-09-28 22:55:28 +10:00

vm-system

feat: migrate vm-system to ArgoCD (#80)

2026-03-27 17:04:15 +11:00

vpa-system

Add vpa-system: VPA CRDs + recommender (advise mode) (#281)

2026-07-25 18:26:15 +10:00

vso-system

feat: migrate vso-system to ArgoCD (#81)

2026-04-07 19:33:50 +10:00

watchstate

watchstate: use canonical upstream image name for alpine (#435)

2026-08-29 21:19:36 +10:00

woodpecker

Add terraform-binarylane woodpecker service account (#537)

2026-10-12 00:22:04 +11:00

kustomization.yaml

feat: initial commit

2026-03-01 14:31:16 +11:00