Update spegel Docker tag to v0.7.0

2026-05-03 00:06:16 +00:00
34 changed files with 71 additions and 332 deletions
@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v2.5.3
+version: v2.5.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v2.5.3
+appVersion: v2.5.2
 dependencies:
  - name: diagrid-dashboard
    version: "0.1.0"
@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v2.5.3
+  tag: v2.5.2
  pullPolicy: IfNotPresent
 init:
  enabled: false
@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v2.5.3
+version: v2.5.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v2.5.3"
+appVersion: "v2.5.2"
@@ -10,7 +10,7 @@ image:
  # This sets the pull policy for images.
  pullPolicy: IfNotPresent
  # Overrides the image tag whose default is the chart appVersion.
-  tag: v2.5.3
+  tag: v2.5.2
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
  - name: gitlab-pull-secret
@@ -47,7 +47,7 @@ service:
  port: 8080
 ingress:
  enabled: true
-  className: haproxy
+  className: nginx
 persistence:
  enabled: false
  size: 1G
@@ -47,7 +47,7 @@ service:
  port: 8080
 ingress:
  enabled: true
-  className: haproxy
+  className: nginx
 persistence:
  enabled: false
  size: 1G
@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v2.5.3
+version: v2.5.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v2.5.3
+appVersion: v2.5.2
 dependencies:
  - name: diagrid-dashboard
    version: "0.1.0"
@@ -5,7 +5,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: v2.5.3
+  tag: v2.5.2
  pullPolicy: IfNotPresent
 init:
  enabled: false
@@ -15,7 +15,7 @@ releases:
 - name: argocd
  namespace: argocd
  chart: argo/argo-cd
-  version: 9.5.4
+  version: 9.5.2
  condition: argo.enabled
  values:
  - ../values/argo/values/argocd.yaml.gotmpl
@@ -43,7 +43,7 @@ releases:
 - name: argo-workflows
  namespace: argocd
  chart: argo/argo-workflows
-  version: 1.0.13
+  version: 1.0.10
  condition: argo.workflows.enabled
  missingFileHandler: Info
 - name: manifests
@@ -1,44 +0,0 @@
-bases:
- - ../envs/environments.yaml.gotmpl
-
-repositories:
- name: haproxytech
-  oci: true
-  url: 'ghcr.io/haproxytech/helm-charts'
-
-commonLabels:
-  tier: system
-
-releases:
- name: ingress-haproxy
-  namespace: ingress-haproxy
-  chart: haproxytech/kubernetes-ingress
-  version: 1.42.0
-  condition: haproxy.enabled
-  values:
-  - ../values/ingress-haproxy/values/ingress-haproxy.yaml.gotmpl
-  - ../values/ingress-haproxy/values/ingress-haproxy-{{ .Environment.Name }}.yaml.gotmpl
-  postRenderer: ../bin/kustomizer
-  postRendererArgs:
-  - ../values/ingress-haproxy/kustomize/{{ .Environment.Name }}
-  missingFileHandler: Info
- name: manifests
-  namespace: ingress-haproxy
-  chart: manifests
-  condition: haproxy.enabled
-  missingFileHandler: Info
-  values:
-  - ../values/env.yaml
-  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  - ../values/ingress-haproxy/env.yaml.gotmpl
-  - ../values/ingress-haproxy/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
-  hooks:
-  - events: [ prepare, cleanup ]
-    showlogs: true
-    command: ../bin/helmify
-    args:
-    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
-    - '{{`{{ .Release.Chart }}`}}'
-    - '{{`{{ .Environment.Name }}`}}'
-    - ../values/ingress-haproxy/manifests
-    - manifests
@@ -15,7 +15,7 @@ releases:
 - name: kyverno
  namespace: kyverno
  chart: kyverno/kyverno
-  version: 3.7.2
+  version: 3.7.1
  condition: kyverno.enabled
  values:
  - ../values/kyverno/values/kyverno.yaml.gotmpl
@@ -12,7 +12,7 @@ releases:
 - name: loki
  namespace: loki
  chart: loki/loki
-  version: 7.0.0
+  version: 6.55.0
  condition: loki.enabled
  values:
  - ../values/loki/values/loki.yaml.gotmpl
@@ -12,7 +12,7 @@ releases:
 - name: opentelemetry-collector
  namespace: otel
  chart: open-telemetry/opentelemetry-collector
-  version: 0.152.0
+  version: 0.150.1
  condition: otel.enabled
  values:
  - ../values/opentelemetry-collector/values/values.yaml
@@ -13,7 +13,7 @@ releases:
 - name: spegel
  namespace: spegel
  chart: spegel/spegel
-  version: 0.6.0
+  version: 0.7.0
  condition: spegel.enabled
  values:
  - ../values/spegel/values/spegel.yaml.gotmpl
@@ -14,7 +14,7 @@ releases:
 - name: umami
  namespace: analytics
  chart: umami/umami
-  version: 7.8.2
+  version: 7.7.20
  condition: umami.enabled
  values:
  - ../values/umami/values/values.yaml
@@ -12,7 +12,7 @@ releases:
 - name: x509-exporter
  namespace: x509-exporter
  chart: x509-exporter/x509-certificate-exporter
-  version: 3.21.0
+  version: 3.20.1
  condition: x509_exporter.enabled
  values:
  - ../values/x509-exporter/values/x509-exporter.yaml.gotmpl
@@ -3,7 +3,7 @@ kind: ConfigMap
 metadata:
  name: staging-atlantis-actor-config
 data:
-  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.12"
+  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.8"
  XTRACT_QUEUE: "dev-queue"
-  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.12"
+  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.8"
  PLUME_QUEUE: "dev-queue"
@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: ea26ac41-debug
+  tag: 5d810716-debug
 podAnnotations:
  dapr.io/app-id: "staging-atlantis"
 env:
@@ -3,14 +3,17 @@ kind: Ingress
 metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-production
-    haproxy.org/backend-protocol: h1
-    haproxy.org/timeout-server: 600s
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
  labels:
    app.kubernetes.io/component: attic
  name: attic
  namespace: attic
 spec:
-  ingressClassName: haproxy
+  ingressClassName: nginx
  rules:
  - host: attic.srv.oceanbox.io
    http:
@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "f040ed60-debug"
+  tag: "ea8cf7dc-debug"
 env:
  - name: APP_VERSION
    value: "0.0.0"
@@ -8,11 +8,13 @@ env:
    value: "1"
 ingress:
  enabled: true
-  className: "haproxy"
+  className: "nginx"
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-production
-    haproxy.org/backend-protocol: h1
-    haproxy.org/cors-enable: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    oceanbox.io/expose: internal
  hosts:
    - host: docs.oceanbox.io
@@ -3,15 +3,17 @@ kind: Ingress
 metadata:
  annotations:
    cert-manager.io/cluster-issuer: ca-issuer
-    haproxy.org/backend-protocol: h1
-    haproxy.org/cors-allow-headers: Content-Type, x-gatus-cache
-    haproxy.org/cors-enable: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/cors-allow-headers: Content-Type, x-gatus-cache
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
  labels:
    app.kubernetes.io/name: gatus
  name: gatus
  namespace: uptime
 spec:
-  ingressClassName: haproxy
+  ingressClassName: nginx
  rules:
    - host: uptime.adm.hel1.obx
      http:
@@ -22,7 +24,7 @@ spec:
                port:
                  number: 80
            path: /
-            pathType: Prefix
+            pathType: ImplementationSpecific
  tls:
    - hosts:
        - uptime.adm.hel1.obx
@@ -135,12 +135,15 @@ gitea:

 ingress:
  enabled: true
-  className: haproxy
+  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-production
-    haproxy.org/backend-protocol: h1
-    haproxy.org/timeout-server: 600s
-    haproxy.org/allow-list: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,100.64.0.0/12,185.125.160.4/32,37.27.203.38/32
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,100.64.0.0/12,185.125.160.4/32,37.27.203.38/32
  hosts:
    - host: git.oceanbox.io
      paths:
@@ -1,15 +0,0 @@
-haproxy:
-  enabled: true
-  autosync: true
-  pdb:
-    minAvailable: 1
-  resources:
-    controller:
-      cpu: "100m"
-      memory: "100Mi"
-  annotations:
-    load-balancer.hetzner.cloud/http-redirect-http: "true"
-    load-balancer.hetzner.cloud/location: hel1
-    load-balancer.hetzner.cloud/name: load-balancer-1
-    load-balancer.hetzner.cloud/type: lb11
-    load-balancer.hetzner.cloud/use-private-ip: "true"
@@ -1,10 +0,0 @@
-haproxy:
-  enabled: false
-  autosync: true
-  pdb:
-    minAvailable: 1
-  resources:
-    controller:
-      cpu: "100m"
-      memory: "100Mi"
-  annotations: []
@@ -1,40 +0,0 @@
-{{- if .Values.clusterConfig.argo.enabled }}
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: ingress-haproxy
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  destination:
-    namespace: ingress-haproxy
-    server: 'https://kubernetes.default.svc'
-  sources:
-  - repoURL: {{ .Values.clusterConfig.manifests }}
-    targetRevision: HEAD
-    path: helmfile.d
-    plugin:
-      name: helmfile-cmp
-      env:
-        - name: CLUSTER_NAME
-          value: {{ .Values.clusterConfig.cluster }}
-        - name: HELMFILE_ENVIRONMENT
-          value: default
-        - name: HELMFILE_FILE_PATH
-          value: ingress-haproxy.yaml.gotmpl
-  project: sys
-  syncPolicy:
-    managedNamespaceMetadata:
-      labels:
-        component: sys
-    syncOptions:
-      - CreateNamespace=true
-      - ApplyOutOfSyncOnly=true
-      - ServerSideApply=true
-    {{- if .Values.haproxy.autosync }}
-    automated:
-      prune: true
-      # selfHeal: false
-    {{- end }}
-{{- end }}
@@ -1,16 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-host-traffic
-  namespace: ingress-haproxy
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-        - host
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: kubernetes-ingress
-      app.kubernetes.io/instance: ingress-haproxy
-{{- end }}
@@ -1,16 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-hubble-traffic
-  namespace: ingress-haproxy
-spec:
-  egress:
-    - toFQDNs:
-        - matchPattern: hubble.*.*.*
-        - matchPattern: hubble.*.*.*.*
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: kubernetes-ingress
-      app.kubernetes.io/instance: ingress-haproxy
-{{- end }}
@@ -1,19 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: ingress-haproxy
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: ingress-haproxy
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "1024"
-              protocol: TCP
-{{- end }}
@@ -1,21 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-world-to-ingress-haproxy
-  namespace: ingress-haproxy
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: kubernetes-ingress
-      app.kubernetes.io/instance: ingress-haproxy
-  ingress:
-    - fromEntities:
-        - world
-    - toPorts:
-        - ports:
-            - port: "80"
-              protocol: TCP
-            - port: "443"
-              protocol: TCP
-{{- end }}
@@ -1,98 +0,0 @@
-## HAProxy Kubernetes Ingress Controller configuration
-## Ref: https://www.haproxy.com/documentation/kubernetes-ingress/
-##
-controller:
-  resources:
-    requests:
-      cpu: {{ .Values.haproxy.resources.controller.cpu }}
-      memory: {{ .Values.haproxy.resources.controller.memory }}
-
-  ingressClass: haproxy
-
-  ingressClassResource:
-    name: haproxy
-    default: true
-
-  config:
-    body-size: "0"
-    tune.bufsize: "131072"
-
-  tolerations:
-   - key: unschedulable
-     operator: Exists
-     effect: NoSchedule
-   - key: node-role.kubernetes.io/control-plane
-     operator: Exists
-     effect: NoSchedule
-
-  affinity:
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: kubernetes.io/hostname
-            operator: In
-            values: {{ .Values.clusterConfig.ingress_nodes }}
-
-    podAntiAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-      - labelSelector:
-          matchExpressions:
-          - key: app.kubernetes.io/instance
-            operator: In
-            values:
-            - ingress-haproxy
-          - key: app.kubernetes.io/name
-            operator: In
-            values:
-            - kubernetes-ingress
-        topologyKey: "kubernetes.io/hostname"
-
-  replicaCount: {{ .Values.clusterConfig.ingress_replica_count }}
-
-  PodDisruptionBudget:
-    enable: true
-    minAvailable: {{ .Values.haproxy.pdb.minAvailable }}
-
-  service:
-  {{- if .Values.clusterConfig.ingress_loadbalancer }}
-    type: LoadBalancer
-    {{- if .Values.clusterConfig.ingress_nodeport }}
-    nodePorts:
-      http: 30080
-      https: 30443
-    {{- end }}
-  {{- else if .Values.clusterConfig.ingress_nodeport }}
-    type: NodePort
-    externalTrafficPolicy: Local
-    nodePorts:
-      http: 30080
-      https: 30443
-  {{- else }}
-    type: ClusterIP
-  {{- end }}
-    annotations:
-      {{- with .Values.haproxy.annotations }}
-      {{ toYaml . | nindent 8 }}
-      {{- end }}
-
-  hostNetwork: {{ .Values.clusterConfig.ingress_hostnetwork }}
-
-  hostPorts:
-    enable: {{ .Values.clusterConfig.ingress_hostport }}
-    http: 80
-    https: 443
-
-  stats:
-    enabled: true
-
-  prometheus:
-    enabled: true
-    port: 1024
-    service:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "1024"
-
-  serviceMonitor:
-    enabled: true
@@ -1,5 +1,5 @@
 nginx:
-  enabled: false
+  enabled: true
  autosync: true
  pdb:
    minAvailable: 1
@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "1c9c91a9-debug"
+  tag: "ad49e745-debug"
 env:
  - name: APP_VERSION
    value: "0.0.0"
@@ -8,11 +8,13 @@ env:
    value: "1"
 ingress:
  enabled: true
-  className: "haproxy"
+  className: "nginx"
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-production
-    haproxy.org/backend-protocol: h1
-    haproxy.org/cors-enable: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    oceanbox.io/expose: internal
  hosts:
    - host: makai.oceanbox.io
@@ -2,11 +2,13 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
+    nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
+    nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
    oceanbox.io/expose: internal
  name: hubble-ui
  namespace: kube-system
 spec:
-  ingressClassName: haproxy
+  ingressClassName: nginx
  rules:
    - host: hubble.hel1.oceanbox.io
      http:
@@ -24,11 +26,13 @@ kind: Ingress
 metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 8k
+    nginx.ingress.kubernetes.io/proxy-busy-buffers-size: 16k
    oceanbox.io/expose: internal
  name: hubble-ui-oauth2-proxy
  namespace: kube-system
 spec:
-  ingressClassName: haproxy
+  ingressClassName: nginx
  rules:
    - host: hubble.hel1.oceanbox.io
      http:
@@ -14,8 +14,9 @@ metadata:
      whitelist to the already existing ones
 spec:
  mutateExistingOnPolicyUpdate: false
+  #precondition: has whitelist annotation or
  rules:
-  - name: ensure-haproxy-allowlist-exists
+  - name: ensure-nginx-whitelist-exists
    skipBackgroundRequests: true
    match:
      resources:
@@ -27,8 +28,8 @@ spec:
      patchStrategicMerge:
        metadata:
          annotations:
-            +(haproxy.org/allow-list): ""
-  - name: append-existing-haproxy-allowlist
+            +(nginx.ingress.kubernetes.io/whitelist-source-range): ""
+  - name: append-existing-whitelist
    skipBackgroundRequests: true
    match:
      resources:
@@ -38,7 +39,7 @@ spec:
          oceanbox.io/expose: internal
    preconditions:
      any:
-      - key: "{{`{{request.object.metadata.annotations.\"haproxy.org/allow-list\"}}`}}"
+      - key: "{{`{{request.object.metadata.annotations.\"nginx.ingress.kubernetes.io/whitelist-source-range\"}}`}}"
        operator: NotEquals
        value: ""
    mutate:
@@ -46,9 +47,9 @@ spec:
        metadata:
          annotations:
            {{- with .Values.clusterConfig.ingress_whitelist }}
-            haproxy.org/allow-list: "{{`{{ @ }}`}},{{ join "," . }}"
+            nginx.ingress.kubernetes.io/whitelist-source-range: "{{`{{ @ }}`}},{{ join "," . }}"
            {{- end }}
-  - name: add-haproxy-allowlist
+  - name: add-nginx-whitelist
    skipBackgroundRequests: true
    match:
      resources:
@@ -58,7 +59,7 @@ spec:
          oceanbox.io/expose: internal
    preconditions:
      any:
-      - key: "{{`{{request.object.metadata.annotations.\"haproxy.org/allow-list\"}}`}}"
+      - key: "{{`{{request.object.metadata.annotations.\"nginx.ingress.kubernetes.io/whitelist-source-range\"}}`}}"
        operator: Equals
        value: ""
    mutate:
@@ -66,6 +67,7 @@ spec:
        metadata:
          annotations:
            {{- with .Values.clusterConfig.ingress_whitelist }}
-            haproxy.org/allow-list: "{{ join "," . }}"
+            nginx.ingress.kubernetes.io/whitelist-source-range: "{{ join "," . }}"
            {{- end }}
 {{- end }}
+