Update ghcr.io/juanfont/headscale Docker tag to v0.28.0

2026-03-17 14:57:21 +00:00
73 changed files with 62 additions and 483 deletions
@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.42.18
+version: v1.46.5
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.42.18
+appVersion: v1.46.5
 dependencies:
  - name: diagrid-dashboard
    version: "0.1.0"
@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v1.42.18
+  tag: v1.46.5
  pullPolicy: IfNotPresent
 init:
  enabled: false
@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v1.42.18
+version: v1.46.5
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v1.42.18"
+appVersion: "v1.46.5"
@@ -10,7 +10,7 @@ image:
  # This sets the pull policy for images.
  pullPolicy: IfNotPresent
  # Overrides the image tag whose default is the chart appVersion.
-  tag: v1.42.18
+  tag: v1.46.5
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
  - name: gitlab-pull-secret
@@ -1,6 +0,0 @@
 dependencies:
 - name: diagrid-dashboard
  repository: file://../diagrid-dashboard
  version: 0.1.0
 digest: sha256:4fdb3148a2a6439223d7844a3083da2de324dd47e5cb3ac4a5d9c436e6e2c775
 generated: "2026-02-25T16:15:48.608231856+01:00"
@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.7.1
+version: v1.6.13
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.7.1
+appVersion: v1.6.13
 dependencies:
  - name: diagrid-dashboard
    version: "0.1.0"
@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/plume/plume
-  tag: v1.7.1
+  tag: v1.6.13
  pullPolicy: IfNotPresent
 init:
  enabled: false
@@ -90,5 +90,6 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
 diagrid-dashboard:
  enabled: false
@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.42.18
+version: v1.46.5
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.42.18
+appVersion: v1.46.5
 dependencies:
  - name: diagrid-dashboard
    version: "0.1.0"
@@ -5,7 +5,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: v1.42.18
+  tag: v1.46.5
  pullPolicy: IfNotPresent
 init:
  enabled: false
@@ -15,7 +15,7 @@ releases:
 - name: argocd
  namespace: argocd
  chart: argo/argo-cd
-  version: 9.4.17
+  version: 9.4.10
  condition: argo.enabled
  values:
  - ../values/argo/values/argocd.yaml.gotmpl
@@ -35,7 +35,7 @@ releases:
 - name: argo-rollouts
  namespace: argocd
  chart: argo/argo-rollouts
-  version: 2.40.9
+  version: 2.40.6
  condition: argo.rollouts.enabled
  values:
  - ../values/argo/values/rollouts.yaml.gotmpl
@@ -43,7 +43,7 @@ releases:
 - name: argo-workflows
  namespace: argocd
  chart: argo/argo-workflows
-  version: 1.0.10
+  version: 0.47.5
  condition: argo.workflows.enabled
  missingFileHandler: Info
 - name: manifests
@@ -1,46 +0,0 @@
 # yaml-language-server: $schema=https://www.schemastore.org/helmfile.json
 bases:
 - ../envs/environments.yaml.gotmpl
 repositories:
 - name: catalyst
  oci: true
  url: 'public.ecr.aws/diagrid'
 commonLabels:
  tier: system
 releases:
 - name: catalyst
  namespace: cra-agent
  chart: catalyst/catalyst
  version: 1.47.0
  condition: catalyst.enabled
  values:
  - ../values/catalyst/values/values.yaml
  - ../values/catalyst/values/values-{{ .Environment.Name }}.yaml
  postRenderer: ../bin/kustomizer
  postRendererArgs:
  - ../values/catalyst/kustomize/{{ .Environment.Name }}
  missingFileHandler: Info
 - name: manifests
  namespace: cra-agent
  chart: manifests
  condition: catalyst.enabled
  missingFileHandler: Info
  values:
  - ../values/env.yaml
  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
  - ../values/catalyst/env.yaml.gotmpl
  - ../values/catalyst/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
  hooks:
  - events: [ prepare, cleanup ]
    showlogs: true
    command: ../bin/helmify
    args:
    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
    - '{{`{{ .Release.Chart }}`}}'
    - '{{`{{ .Environment.Name }}`}}'
    - ../values/catalyst/manifests
    - manifests
@@ -13,7 +13,7 @@ releases:
 - name: cert-manager
  namespace: cert-manager
  chart: cert-manager/cert-manager
-  version: v1.20.2
+  version: v1.19.4
  condition: cert_manager.enabled
  values:
  - ../values/cert-manager/values/cert-manager.yaml.gotmpl
@@ -13,7 +13,7 @@ releases:
 - name: dragonfly
  namespace: dragonfly
  chart: dragonfly/dragonfly-operator
-  version: v1.5.0
+  version: v1.4.0
  condition: dragonfly.enabled
  values:
  - ../values/dragonfly/values/dragonfly.yaml.gotmpl
@@ -13,7 +13,7 @@ releases:
 - name: gitea
  namespace: gitea
  chart: gitea/gitea
-  version: 12.5.3
+  version: 12.5.0
  condition: gitea.enabled
  values:
  - ../values/gitea/values/values.yaml
@@ -12,7 +12,7 @@ releases:
 - name: ingress-nginx
  namespace: ingress-nginx
  chart: ingress-nginx/ingress-nginx
-  version: 4.15.1
+  version: 4.14.3
  condition: nginx.enabled
  values:
  - ../values/ingress-nginx/values/ingress-nginx.yaml.gotmpl
@@ -8,7 +8,7 @@ releases:
 - name: kueue
  namespace: kueue-system
  chart: oci://registry.k8s.io/kueue/charts/kueue
-  version: 0.17.1
+  version: 0.16.2
  condition: kueue.enabled
  values:
  - ../values/kueue/values/values.yaml
@@ -12,7 +12,7 @@ releases:
 - name: loki
  namespace: loki
  chart: loki/loki
-  version: 6.55.0
+  version: 6.53.0
  condition: loki.enabled
  values:
  - ../values/loki/values/loki.yaml.gotmpl
@@ -12,7 +12,7 @@ releases:
 - name: mariadb-operator
  namespace: mariadb-operator
  chart: mariadb-operator/mariadb-operator
-  version: 26.3.0
+  version: 25.10.4
  condition: mariadb_operator.enabled
  values:
  - ../values/mariadb-operator/values/mariadb-operator.yaml.gotmpl
@@ -16,7 +16,7 @@ releases:
  namespace: {{ .Environment.Name }}-openfga
  {{- end }}
  chart: openfga/openfga
-  version: 0.3.2
+  version: 0.2.56
  condition: openfga.enabled
  values:
  - ../values/openfga/values/values.yaml
@@ -12,7 +12,7 @@ releases:
 - name: opentelemetry-collector
  namespace: otel
  chart: open-telemetry/opentelemetry-collector
-  version: 0.150.1
+  version: 0.146.1
  condition: otel.enabled
  values:
  - ../values/opentelemetry-collector/values/values.yaml
@@ -15,7 +15,7 @@ releases:
 - name: prometheus
  namespace: prometheus
  chart: prometheus/kube-prometheus-stack
-  version: 82.15.1
+  version: 82.10.3
  condition: prometheus.enabled
  values:
  - ../values/prometheus/values/prometheus.yaml.gotmpl
@@ -13,7 +13,7 @@ releases:
 - name: slurm-operator
  namespace: slinky
  chart: slurm-operator/slurm-operator
-  version: 1.0.3
+  version: 1.0.2
  condition: slurm_operator.enabled
  values:
  - ../values/slurm-operator/values/slurm-operator.yaml.gotmpl
@@ -13,7 +13,7 @@ releases:
 - name: slurm
  namespace: slurm
  chart: slurm/slurm
-  version: 1.0.3
+  version: 1.0.2
  condition: slurm.enabled
  values:
  - ../values/slurm/values/slurm.yaml.gotmpl
@@ -14,7 +14,7 @@ releases:
 - name: umami
  namespace: analytics
  chart: umami/umami
-  version: 7.7.20
+  version: 7.7.3
  condition: umami.enabled
  values:
  - ../values/umami/values/values.yaml
@@ -12,7 +12,7 @@ releases:
 - name: x509-exporter
  namespace: x509-exporter
  chart: x509-exporter/x509-certificate-exporter
-  version: 3.20.1
+  version: 3.19.1
  condition: x509_exporter.enabled
  values:
  - ../values/x509-exporter/values/x509-exporter.yaml.gotmpl
@@ -25,7 +25,7 @@ treefmt.evalModule pkgs {
    # --- Nix formatting ---
    nixfmt = {
      enable = true;
-      package = pkgs.nixfmt;
+      package = pkgs.nixfmt-rfc-style;
    };
    statix.enable = true;
    deadnix.enable = true;
@@ -96,10 +96,6 @@ spec:
    server: https://kubernetes.default.svc
  - namespace: dex
    server: https://kubernetes.default.svc
  - namespace: cra-agent
    server: https://kubernetes.default.svc
  - namespace: catalyst
    server: https://kubernetes.default.svc
  sourceRepos:
  - https://argoproj.github.io/argo-helm
  - https://kubernetes-sigs.github.io/metrics-server/
@@ -143,8 +139,7 @@ spec:
  - ghcr.io/dragonflydb/dragonfly-operator/helm/dragonfly-operator
  - docker.gitea.com
  - https://operator.mariadb.com/mariadb-enterprise-operator
  - https://ot-container-kit.github.io/helm-charts
  - https://operator.mariadb.com
  - https://ot-container-kit.github.io/helm-charts
  - https://twin.github.io/helm-charts
  - https://charts.dexidp.io
  - public.ecr.aws/diagrid/catalyst
@@ -1,9 +0,0 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: beta-atlantis-actor-config
 data:
  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.8"
  XTRACT_QUEUE: "prod-queue"
  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.8"
  PLUME_QUEUE: "prod-queue"
@@ -7,9 +7,4 @@
  path: /spec/template/spec/containers/0/envFrom/-
  value:
    secretRef:
-      name: prod-atlantis-env
+      name: prod-atlantis-env
 - op: add
  path: /spec/template/spec/containers/0/envFrom/-
  value:
    configMapRef:
      name: beta-atlantis-actor-config
@@ -14,7 +14,6 @@ patches:
 resources:
  - ../base
  - rbac.yaml
  - actor-config.yaml
  - tracing.yaml
  - bindings.yaml
  - pubsub.yaml
@@ -8,7 +8,6 @@ rules:
  - ""
  resourceNames:
  - beta-atlantis-appsettings
  - beta-atlantis-actor-config
  resources:
  - configmaps
  verbs:
@@ -1,9 +0,0 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: prod-atlantis-actor-config
 data:
  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.8"
  XTRACT_QUEUE: "prod-queue"
  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.8"
  PLUME_QUEUE: "prod-queue"
@@ -7,9 +7,4 @@
  path: /spec/template/spec/containers/0/envFrom/-
  value:
    secretRef:
-      name: prod-atlantis-env
+      name: prod-atlantis-env
 - op: add
  path: /spec/template/spec/containers/0/envFrom/-
  value:
    configMapRef:
      name: prod-atlantis-actor-config
@@ -13,7 +13,6 @@ patches:
 resources:
  - ../base
  - secrets.yaml
  - actor-config.yaml
  - rbac.yaml
  - tracing.yaml
  - bindings.yaml
@@ -8,7 +8,6 @@ rules:
  - ""
  resourceNames:
  - prod-atlantis-appsettings
  - prod-atlantis-actor-config
  resources:
  - configmaps
  verbs:
@@ -1,9 +0,0 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: staging-atlantis-actor-config
 data:
  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.8"
  XTRACT_QUEUE: "dev-queue"
  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.8"
  PLUME_QUEUE: "dev-queue"
@@ -7,9 +7,4 @@
  path: /spec/template/spec/containers/0/envFrom/-
  value:
    secretRef:
-      name: staging-atlantis-env
+      name: staging-atlantis-env
 - op: add
  path: /spec/template/spec/containers/0/envFrom/-
  value:
    configMapRef:
      name: staging-atlantis-actor-config
@@ -14,7 +14,6 @@ resources:
  - ../base
  - rbac.yaml
  - secrets.yaml
  - actor-config.yaml
  - tracing.yaml
  - bindings.yaml
  - pubsub.yaml
@@ -22,4 +21,4 @@ resources:
  - subscriptions.yaml
  - configurations.yaml
  - secretstore.yaml
-  - keyvault.yaml
+  - keyvault.yaml
@@ -8,7 +8,6 @@ rules:
  - ""
  resourceNames:
  - staging-atlantis-appsettings
  - staging-atlantis-actor-config
  resources:
  - configmaps
  verbs:
@@ -2,7 +2,7 @@ replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v1.48.1
+  tag: v1.46.2
 podAnnotations:
  dapr.io/app-id: "beta-atlantis"
@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: d83c8790-debug
+  tag: 23006866-debug
 podAnnotations:
  dapr.io/app-id: "staging-atlantis"
 env:
@@ -1,3 +0,0 @@
 catalyst:
  enabled: true
  autosync: false
@@ -1,4 +0,0 @@
 catalyst:
  enabled: false
  autosync: false
  env: {{ .Environment.Name }}
@@ -1,42 +0,0 @@
 {{- if .Values.clusterConfig.argo.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: catalyst
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
  finalizers:
  - resources-finalizer.argocd.argoproj.io
 spec:
  destination:
    namespace: cra-agent
    server: https://kubernetes.default.svc
  project: sys
  sources:
  - repoURL: {{ .Values.clusterConfig.manifests }}
    targetRevision: HEAD
    path: helmfile.d
    plugin:
      name: helmfile-cmp
      env:
      - name: CLUSTER_NAME
        value: {{ .Values.clusterConfig.cluster }}
      - name: HELMFILE_ENVIRONMENT
        value: {{ .Values.catalyst.env }}
      - name: HELMFILE_FILE_PATH
        value: catalyst.yaml.gotmpl
  syncPolicy:
    managedNamespaceMetadata:
      labels:
        component: aux
    syncOptions:
      - CreateNamespace=true
      - ApplyOutOfSyncOnly=true
      # - ServerSideApply=true
    {{- if .Values.catalyst.autosync }}
    automated:
      prune: true
      # selfHeal: false
    {{- end }}
 {{- end }}
@@ -1,11 +0,0 @@
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
  name: catalyst-db
  namespace: cra-agent
 spec:
  instances: 1
  imageName: ghcr.io/cloudnative-pg/postgresql:18
  storage:
    resizeInUseVolumes: true
    size: 10Gi
@@ -1,15 +0,0 @@
 {{- if .Values.clusterConfig.cilium.enabled }}
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-api-catalyst
  namespace: cra-agent
 spec:
  description: Allow Catalyst API
  egress:
    - toFQDNs:
        - matchPattern: binaries.prisma.sh
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: cra-agent
 {{- end }}
@@ -1,18 +0,0 @@
 agent:
  config:
    project:
      default_managed_state_store_type: postgresql-shared-external
      external_postgresql:
        enabled: true
        auth_type: connectionString
        namespace: postgres
        connection_string_host: catalyst-db-rw.cra-agent.svc.cluster.local
        connection_string_port: 5432
        connection_string_username: app
        connection_string_password: 5kDx7c9rSXxk32uEhCnMMHIpSWtg85SXDcpRJg58qskDMTtaalxWdCR9SfBcayjw
        connection_string_database: app
 gateway:
  tls:
    enabled: true
    existingSecret: cra-agent-tls
 join_token: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsidXJuOmNsb3VkZ3JpZCIsInVybjphZG1pbmdyaWQiXSwiZXhwIjoxNzc2MjU4MjE4LCJob3N0SWQiOiJ6dnpna3p6cyIsImh0dHBzOi8vZGlhZ3JpZC5pby9lbWFpbCI6IiIsImh0dHBzOi8vZGlhZ3JpZC5pby9vcmdJZCI6ImNhMzRjMWY5LTliMWMtNGI5Yi04MDlhLWI3MTgzYTE1MWQxMiIsImlzcyI6ImRpYWdyaWQuaW8iLCJqdGkiOiI5NTc3NDk1Nzc5NDQ1OTgyIiwicmVnaW9uSWQiOiJraW5kLXJlZ2lvbiIsInN1YiI6ImpvaW5Ub2tlbiJ9.a-xAzGsnDHGFoNRt4cR6BSihyirSCvy_EhksEu0Ok2g"
@@ -12,7 +12,7 @@ cilium:
    enabled: true
  # kube-proxy stays running during migration; disable replacement until done.
  # TODO: set to true after migration
-  kubeProxyReplacement: true
+  kubeProxyReplacement: false
  # Direct apiserver connection -- do not rely on the kubernetes service IP
  # during migration since we are touching the CNI layer.
  # TODO: remove k8sServiceHost / k8sServicePort (or keep pointing at apiserver localhost)
@@ -1,7 +1,5 @@
 cilium:
  enabled: true
  clustermesh:
    enabled: false
  envoy:
    enabled: true
  nodePort:
@@ -38,4 +38,4 @@ volumeMounts:
    readOnly: true
    subPath: appsettings.json
 image:
-  tag: 74ed3e11-debug
+  tag: 38eeb4cc-debug
@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "6960aed0-debug"
+  tag: "0d279bb9-debug"
 env:
  - name: APP_VERSION
    value: "0.0.0"
@@ -8,7 +8,7 @@ clusterConfig:
  initca: "/var/lib/kubernetes/secrets"
  apiserver: "ekman-manage"
  apiserverip: "10.255.241.99"
-  etcd_nodes: ["10.255.241.80, 10.255.241.100, 10.255.241.99"]
+  etcd_nodes: ["10.255.241.80, 10.255.241.90, 10.255.241.99"]
  k8s_nodes:
    [
      "10.255.241.80, 10.255.241.90, 10.255.241.99, 10.255.241.100, 10.255.241.101, 10.255.241.102, 10.255.241.103, 10.255.241.104, 10.255.241.105, 10.255.241.106, 10.255.241.107, 10.255.241.108, 10.255.241.109, 10.255.241.110, 10.255.241.111, 10.255.241.112, 10.255.241.113, 10.255.241.114, 10.255.241.116, 10.255.241.121, 10.255.241.122, 10.255.241.123, 10.255.241.124, 10.255.241.125, 10.255.241.126, 10.255.241.127, 10.255.241.128",
@@ -139,3 +139,12 @@ config:
        environment: staging
      alerts:
        - type: custom
    - name: Plume Dev TOS
      <<: *https-endpoint
      group: "Experimental Services"
      url: https://plume.ekman.oceanbox.io/healthz
      extra-labels:
        environment: staging
      alerts:
        - type: custom
@@ -1,7 +1,7 @@
 image:
  repository: ghcr.io/juanfont/headscale
  pullPolicy: IfNotPresent
-  tag: v0.27.1
+  tag: v0.28.0
 args: [ "serve" ]
@@ -13,7 +13,7 @@ env:
  HEADSCALE_OIDC_ONLY_START_IF_OIDC_IS_AVAILABLE: "true"
  HEADSCALE_OIDC_ISSUER: "https://login.microsoftonline.com/3f737008-e9a0-4485-9d27-40329d288089/v2.0"
  HEADSCALE_OIDC_CLIENT_ID: "688e9096-f140-4498-a46a-e3d1939184de"
-  HEADSCALE_OIDC_CLIENT_SECRET: "wms8Q~RC7xyAmIoocVe.gIFGpJw-Odmtep0ZObDn"
+  HEADSCALE_OIDC_CLIENT_SECRET: "dPW8Q~1rctY-D0Ih.A1-1KqLl0uj1rX_ixNTcbrh"
  # -- Split DNS for obx and ts.obx
  HEADSCALE_DNS_NAMESERVERS_SPLIT: |
@@ -1,7 +1,7 @@
 image:
  repository: ghcr.io/juanfont/headscale
  pullPolicy: IfNotPresent
-  tag: v0.27.1
+  tag: v0.28.0
 args: ["serve"]
@@ -13,7 +13,7 @@ env:
  HEADSCALE_OIDC_ONLY_START_IF_OIDC_IS_AVAILABLE: "true"
  HEADSCALE_OIDC_ISSUER: "https://login.microsoftonline.com/3f737008-e9a0-4485-9d27-40329d288089/v2.0"
  HEADSCALE_OIDC_CLIENT_ID: "688e9096-f140-4498-a46a-e3d1939184de"
-  HEADSCALE_OIDC_CLIENT_SECRET: "wms8Q~RC7xyAmIoocVe.gIFGpJw-Odmtep0ZObDn"
+  HEADSCALE_OIDC_CLIENT_SECRET: "dPW8Q~1rctY-D0Ih.A1-1KqLl0uj1rX_ixNTcbrh"
  # -- Split DNS for obx and ts.obx
  HEADSCALE_DNS_NAMESERVERS_SPLIT: |
@@ -255,7 +255,6 @@ configMaps:
            { "action": "accept", "src": [ "faith.iha@oceanbox.io" ], "dst": [ "faith.iha@oceanbox.io:*" ] },
            { "action": "accept", "src": [ "elianne.ersdal@oceanbox.io" ], "dst": [  "elianne.ersdal@oceanbox.io:*" ] },
            { "action": "accept", "src": [ "hanskristian.djuve@oceanbox.io" ], "dst": [ "hanskristian.djuve@oceanbox.io:*" ] },
            { "action": "accept", "src": [ "erlend.mundal@oceanbox.io" ], "dst": [ "erlend.mundal@oceanbox.io:*" ] },
            // s/"\([^"]*\)"/{ "action": "accept", "src": [ "\1" ], "dst": [ "\1:*" ] },
          ]
        }
@@ -354,7 +353,7 @@ configMaps:
           { "name": "mrtz-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
           { "name": "mrtz-sorcerer.dev.vtn.obx", "type": "A", "value": "172.16.239.221" },
           { "name": "mrtz-plume.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
-           { "name": "mrtz-diadash.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
+           { "name": "mrtz-diadash.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
           { "name": "simkir-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "simkir-maps.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "simkir-codex.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
@@ -48,29 +48,12 @@ metadata:
 apiVersion: kueue.x-k8s.io/v1beta2
 kind: LocalQueue
 metadata:
-  name: dev-queue
+  name: staging-queue
  namespace: dev-queue
  annotations:
    argocd.argoproj.io/sync-wave: "2"
 spec:
  clusterQueue: cluster-queue
 ---
 apiVersion: v1
 kind: Namespace
 metadata:
  name: prod-queue
  annotations:
    argocd.argoproj.io/sync-wave: "2"
 ---
 apiVersion: kueue.x-k8s.io/v1beta2
 kind: LocalQueue
 metadata:
  name: prod-queue
  namespace: prod-queue
  annotations:
    argocd.argoproj.io/sync-wave: "2"
 spec:
  clusterQueue: cluster-queue
 # ---
 # apiVersion: kueue.x-k8s.io/v1beta2
 # kind: WorkloadPriorityClass
@@ -1,117 +0,0 @@
 # Cross-namespace RBAC: allow sorcerer ServiceAccounts to manage JobSets in dev-queue
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: beta-sorcerer-prod-queue
  namespace: prod-queue
 rules:
 - apiGroups:
  - jobset.x-k8s.io
  resources:
  - jobsets
  verbs:
  - create
  - delete
  - get
  - list
  - watch
 - apiGroups:
  - ""
  resources:
  - pods
  - pods/log
  verbs:
  - get
  - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: beta-sorcerer-prod-queue
  namespace: prod-queue
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: beta-sorcerer-prod-queue
 subjects:
 - kind: ServiceAccount
  name: beta-sorcerer
  namespace: beta-sorcerer
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: prod-sorcerer-prod-queue
  namespace: prod-queue
 rules:
 - apiGroups:
  - jobset.x-k8s.io
  resources:
  - jobsets
  verbs:
  - create
  - delete
  - get
  - list
  - watch
 - apiGroups:
  - ""
  resources:
  - pods
  - pods/log
  verbs:
  - get
  - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: prod-sorcerer-prod-queue
  namespace: prod-queue
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: prod-sorcerer-prod-queue
 subjects:
 - kind: ServiceAccount
  name: prod-sorcerer
  namespace: prod-sorcerer
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: staging-sorcerer-dev-queue
  namespace: dev-queue
 rules:
 - apiGroups:
  - jobset.x-k8s.io
  resources:
  - jobsets
  verbs:
  - create
  - delete
  - get
  - list
  - watch
 - apiGroups:
  - ""
  resources:
  - pods
  - pods/log
  verbs:
  - get
  - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: staging-sorcerer-dev-queue
  namespace: dev-queue
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: staging-sorcerer-dev-queue
 subjects:
 - kind: ServiceAccount
  name: staging-sorcerer
  namespace: staging-sorcerer
@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "36e2cb4d-debug"
+  tag: "d5e61949-debug"
 env:
  - name: APP_VERSION
    value: "0.0.0"
@@ -1,7 +1,7 @@
-replicaCount: 0
+replicaCount: 1
 image:
  repository: "git.oceanbox.io/oceanbox/plume/plume"
-  tag: 0095aa5a-debug
+  tag: v1.6.13
 podAnnotations:
  dapr.io/enabled: "true"
  dapr.io/app-id: "staging-plume"
@@ -11,9 +11,4 @@
  value:
    secretRef:
      name: prod-sorcerer-env
 - op: add
  path: /spec/template/spec/containers/0/envFrom/-
  value:
    configMapRef:
      name: beta-sorcerer-kueue-config
@@ -1,7 +0,0 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: beta-sorcerer-kueue-config
 data:
  KUEUE_NAMESPACE: "prod-queue"
  KUEUE_ARCHIVE_PVC: "prod-queue-ceph-archives"
@@ -18,7 +18,6 @@ resources:
 - configurations.yaml
 - keyvault.yaml
 - rbac.yaml
 - kueue-config.yaml
 - secretstore.yaml
 - statestore.yaml
 - tracing.yaml
@@ -8,7 +8,6 @@ rules:
  - ""
  resourceNames:
  - beta-sorcerer-appsettings
  - beta-sorcerer-kueue-config
  resources:
  - configmaps
  verbs:
@@ -24,24 +23,6 @@ rules:
  verbs:
  - get
  - watch
 - apiGroups:
  - jobset.x-k8s.io
  resources:
  - jobsets
  verbs:
  - create
  - delete
  - get
  - list
  - watch
 - apiGroups:
  - ""
  resources:
  - pods
  - pods/log
  verbs:
  - get
  - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -11,9 +11,4 @@
  value:
    secretRef:
      name: prod-sorcerer-env
 - op: add
  path: /spec/template/spec/containers/0/envFrom/-
  value:
    configMapRef:
      name: prod-sorcerer-kueue-config
@@ -1,7 +0,0 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: prod-sorcerer-kueue-config
 data:
  KUEUE_NAMESPACE: "prod-queue"
  KUEUE_ARCHIVE_PVC: "prod-queue-ceph-archives"
@@ -18,7 +18,6 @@ resources:
 - configurations.yaml
 - keyvault.yaml
 - rbac.yaml
 - kueue-config.yaml
 - secretstore.yaml
 - statestore.yaml
 - tracing.yaml
@@ -8,7 +8,6 @@ rules:
  - ""
  resourceNames:
  - prod-sorcerer-appsettings
  - prod-sorcerer-kueue-config
  resources:
  - configmaps
  verbs:
@@ -24,24 +23,6 @@ rules:
  verbs:
  - get
  - watch
 - apiGroups:
  - jobset.x-k8s.io
  resources:
  - jobsets
  verbs:
  - create
  - delete
  - get
  - list
  - watch
 - apiGroups:
  - ""
  resources:
  - pods
  - pods/log
  verbs:
  - get
  - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -11,9 +11,4 @@
  value:
    secretRef:
      name: staging-sorcerer-env
 - op: add
  path: /spec/template/spec/containers/0/envFrom/-
  value:
    configMapRef:
      name: staging-sorcerer-kueue-config
@@ -1,7 +0,0 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: staging-sorcerer-kueue-config
 data:
  KUEUE_NAMESPACE: "dev-queue"
  KUEUE_ARCHIVE_PVC: "dev-queue-ceph-archives"
@@ -18,7 +18,6 @@ resources:
 - configurations.yaml
 - keyvault.yaml
 - rbac.yaml
 - kueue-config.yaml
 - secretstore.yaml
 - statestore.yaml
 - tracing.yaml
@@ -8,7 +8,6 @@ rules:
  - ""
  resourceNames:
  - staging-sorcerer-appsettings
  - staging-sorcerer-kueue-config
  resources:
  - configmaps
  verbs:
@@ -24,24 +23,6 @@ rules:
  verbs:
  - get
  - watch
 - apiGroups:
  - jobset.x-k8s.io
  resources:
  - jobsets
  verbs:
  - create
  - delete
  - get
  - list
  - watch
 - apiGroups:
  - ""
  resources:
  - pods
  - pods/log
  verbs:
  - get
  - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -2,7 +2,7 @@ replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: v1.48.1
+  tag: v1.46.2
 podAnnotations:
  dapr.io/enabled: "true"
@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: 74ed3e11-debug
+  tag: 38eeb4cc-debug
 podAnnotations:
  dapr.io/enabled: "true"
  dapr.io/app-id: "staging-sorcerer"