From b8b53467be4aec44f5d3f95f96b2656736f86494 Mon Sep 17 00:00:00 2001 From: chemavx Date: Wed, 22 Jul 2026 09:11:10 +0000 Subject: [PATCH] =?UTF-8?q?fija=20las=20im=C3=A1genes=20flotantes=20de=20l?= =?UTF-8?q?os=20namespaces=20manuales?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit El commit 22ae5d7 (15-abr) fijó estos tags EN GIT pero nunca se aplicó al cluster: estos namespaces no están en ArgoCD, así que un cambio en git no llega solo. Tres meses después git decía 1.25.5 y gitea corría 1.27.0, subido en algún reinicio sin que nadie lo decidiera. Ahora se fija a los dos lados. gitea gitea/gitea:latest -> gitea/gitea:1.27.0 gitea (init) busybox -> busybox:1.38.0 gitea-runner gitea/act_runner:latest -> gitea/act_runner:0.6.1 gitea-runner docker:24-dind -> docker:24.0.9-dind authentik-redis redis:alpine -> redis:8.8.0-alpine uptime-kuma louislam/uptime-kuma:1 -> louislam/uptime-kuma:1.23.17 homarr homarr:latest -> homarr@sha256:80ee593c... Los seis primeros se fijan a la MISMA imagen que ya corría: verificado comparando el repoDigest del tag flotante con el del tag candidato, así que el reinicio no cambió de versión. Homarr va por digest porque su "latest" es una build de la rama main (org.opencontainers.image.version=main): no existe un tag de release que describa lo que corre. Moverlo a una release es otra decisión. Trampa que casi me come, anotada para la próxima: el imageID de un pod NO siempre es el digest del registro. Si viene como "repo@sha256:..." lo es; si es un "sha256:..." pelado es el id local de containerd y NO se puede descargar. Fijar uptime-kuma a ese id dio ImagePullBackOff; el pod viejo aguantó sirviendo (maxUnavailable 0 para 1 réplica) y se revirtió sin corte. La comparación buena es repoDigest contra repoDigest. De paso, al regenerar gitea-runner desde lo vivo quedan documentados el volumen buildkitd-config y su montaje, que existían en el cluster y no en git. Verificado tras cada cambio: rollout completo, versión de la app dentro del pod, y los cinco servicios respondiendo desde fuera (git 200, home 200, status/auth/ grafana 302 por Authentik). El runner se ha vuelto a registrar en Gitea. Sigue sin haber pods fuera de Running y las 18 apps de ArgoCD Synced+Healthy. Co-Authored-By: Claude Opus 4.8 --- authentik/deployment-authentik-redis.yaml | 8 +- gitea/deployment-gitea-runner.yaml | 117 ++++++++++++++-------- gitea/statefulset-gitea.yaml | 7 +- homarr/deployment-homarr.yaml | 10 +- monitoring/deployment-uptime-kuma.yaml | 8 -- 5 files changed, 79 insertions(+), 71 deletions(-) diff --git a/authentik/deployment-authentik-redis.yaml b/authentik/deployment-authentik-redis.yaml index 99799e4..8a02217 100644 --- a/authentik/deployment-authentik-redis.yaml +++ b/authentik/deployment-authentik-redis.yaml @@ -1,11 +1,6 @@ apiVersion: apps/v1 kind: Deployment metadata: - annotations: - deployment.kubernetes.io/revision: '1' - kubectl.kubernetes.io/last-applied-configuration: '{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{},"name":"authentik-redis","namespace":"authentik"},"spec":{"replicas":1,"selector":{"matchLabels":{"app":"authentik-redis"}},"template":{"metadata":{"labels":{"app":"authentik-redis"}},"spec":{"containers":[{"command":["redis-server","--save","60","1","--loglevel","warning"],"image":"redis:alpine","name":"redis","ports":[{"containerPort":6379}],"resources":{"limits":{"cpu":"100m","memory":"128Mi"},"requests":{"cpu":"25m","memory":"64Mi"}}}]}}}} - - ' name: authentik-redis namespace: authentik spec: @@ -33,7 +28,7 @@ spec: - '1' - --loglevel - warning - image: redis:8.6.2-alpine + image: redis:8.8.0-alpine imagePullPolicy: IfNotPresent name: redis ports: @@ -53,4 +48,3 @@ spec: schedulerName: default-scheduler securityContext: {} terminationGracePeriodSeconds: 30 - diff --git a/gitea/deployment-gitea-runner.yaml b/gitea/deployment-gitea-runner.yaml index 23faa60..fbf4449 100644 --- a/gitea/deployment-gitea-runner.yaml +++ b/gitea/deployment-gitea-runner.yaml @@ -1,76 +1,75 @@ apiVersion: apps/v1 kind: Deployment metadata: - name: gitea-runner - namespace: gitea labels: app: gitea-runner + name: gitea-runner + namespace: gitea spec: + progressDeadlineSeconds: 600 replicas: 1 + revisionHistoryLimit: 10 selector: matchLabels: app: gitea-runner + strategy: + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + type: RollingUpdate template: metadata: + annotations: + kubectl.kubernetes.io/restartedAt: '2026-05-05T09:17:26Z' labels: app: gitea-runner spec: - nodeSelector: - kubernetes.io/hostname: chemavx-k8 - restartPolicy: Always - volumes: - - name: runner-data - emptyDir: {} - - name: runner-config - configMap: - name: gitea-runner-config - - name: dind-storage - emptyDir: - sizeLimit: "10Gi" - - name: docker-daemon-config - configMap: - name: docker-daemon-config containers: - - name: dind - image: docker:24-dind - imagePullPolicy: IfNotPresent - args: + - args: - --host=tcp://0.0.0.0:2375 - --tls=false env: - name: DOCKER_TLS_CERTDIR - value: "" - securityContext: - privileged: true + image: docker:24.0.9-dind + imagePullPolicy: IfNotPresent + livenessProbe: + exec: + command: + - docker + - info + failureThreshold: 3 + initialDelaySeconds: 20 + periodSeconds: 30 + successThreshold: 1 + timeoutSeconds: 1 + name: dind resources: + limits: + cpu: '2' + memory: 4Gi requests: cpu: 500m memory: 2Gi - limits: - cpu: "2" - memory: 4Gi - livenessProbe: - exec: - command: ["docker", "info"] - initialDelaySeconds: 20 - periodSeconds: 30 - failureThreshold: 3 + securityContext: + privileged: true + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File volumeMounts: - mountPath: /var/lib/docker name: dind-storage - mountPath: /etc/docker/daemon.json name: docker-daemon-config subPath: daemon.json - - name: runner - image: gitea/act_runner:latest - imagePullPolicy: Always - command: - - /bin/sh - - -c - args: + - mountPath: /etc/buildkit/buildkitd.toml + name: buildkitd-config + subPath: buildkitd.toml + - args: - | until nc -z localhost 2375 2>/dev/null; do sleep 1; done exec /usr/local/bin/run.sh + command: + - /bin/sh + - -c env: - name: GITEA_INSTANCE_URL value: http://gitea.gitea.svc.cluster.local:3000 @@ -81,19 +80,49 @@ spec: - name: GITEA_RUNNER_REGISTRATION_TOKEN valueFrom: secretKeyRef: - name: gitea-runner-secret-infisical key: GITEA_RUNNER_REGISTRATION_TOKEN + name: gitea-runner-secret-infisical - name: DOCKER_HOST value: tcp://localhost:2375 + image: gitea/act_runner:0.6.1 + imagePullPolicy: Always + name: runner resources: + limits: + cpu: '1' + memory: 512Mi requests: cpu: 100m memory: 128Mi - limits: - cpu: "1" - memory: 512Mi + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File volumeMounts: - mountPath: /data name: runner-data - mountPath: /etc/act_runner name: runner-config + dnsPolicy: ClusterFirst + nodeSelector: + kubernetes.io/hostname: chemavx-k8 + restartPolicy: Always + schedulerName: default-scheduler + securityContext: {} + terminationGracePeriodSeconds: 30 + volumes: + - emptyDir: {} + name: runner-data + - configMap: + defaultMode: 420 + name: gitea-runner-config + name: runner-config + - emptyDir: + sizeLimit: 10Gi + name: dind-storage + - configMap: + defaultMode: 420 + name: docker-daemon-config + name: docker-daemon-config + - configMap: + defaultMode: 420 + name: buildkitd-config + name: buildkitd-config diff --git a/gitea/statefulset-gitea.yaml b/gitea/statefulset-gitea.yaml index 0f9ecf5..fafbf35 100644 --- a/gitea/statefulset-gitea.yaml +++ b/gitea/statefulset-gitea.yaml @@ -16,6 +16,8 @@ spec: serviceName: gitea template: metadata: + annotations: + kubectl.kubernetes.io/restartedAt: '2026-04-13T16:09:54Z' labels: app: gitea spec: @@ -41,7 +43,7 @@ spec: value: '1000' - name: USER_GID value: '1000' - image: gitea/gitea:1.25.5 + image: gitea/gitea:1.27.0 imagePullPolicy: Always name: gitea ports: @@ -67,7 +69,7 @@ spec: - sh - -c - mkdir -p /data/gitea/conf && chown -R 1000:1000 /data - image: busybox + image: busybox:1.38.0 imagePullPolicy: Always name: init-dirs resources: {} @@ -88,4 +90,3 @@ spec: rollingUpdate: partition: 0 type: RollingUpdate - diff --git a/homarr/deployment-homarr.yaml b/homarr/deployment-homarr.yaml index b016378..b4b3485 100644 --- a/homarr/deployment-homarr.yaml +++ b/homarr/deployment-homarr.yaml @@ -1,11 +1,6 @@ apiVersion: apps/v1 kind: Deployment metadata: - annotations: - deployment.kubernetes.io/revision: '5' - kubectl.kubernetes.io/last-applied-configuration: '{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{},"name":"homarr","namespace":"homarr"},"spec":{"replicas":1,"selector":{"matchLabels":{"app":"homarr"}},"template":{"metadata":{"labels":{"app":"homarr"}},"spec":{"containers":[{"env":[{"name":"SECRET_ENCRYPTION_KEY","value":"a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"},{"name":"AUTH_PROVIDERS","value":"credentials"},{"name":"BASE_URL","value":"https://homarr.chemavx.xyz"}],"image":"ghcr.io/homarr-labs/homarr:latest","name":"homarr","ports":[{"containerPort":7575}],"resources":{"limits":{"cpu":"300m","memory":"512Mi"},"requests":{"cpu":"50m","memory":"128Mi"}},"volumeMounts":[{"mountPath":"/appdata/db","name":"db"},{"mountPath":"/appdata/redis","name":"redis"}]}],"volumes":[{"name":"db","persistentVolumeClaim":{"claimName":"homarr-db-pvc"}},{"name":"redis","persistentVolumeClaim":{"claimName":"homarr-redis-pvc"}}]}}}} - - ' name: homarr namespace: homarr spec: @@ -22,8 +17,6 @@ spec: type: RollingUpdate template: metadata: - annotations: - kubectl.kubernetes.io/restartedAt: '2026-04-09T20:09:03Z' labels: app: homarr spec: @@ -45,7 +38,7 @@ spec: value: Authentik - name: AUTH_OIDC_AUTO_LOGIN value: 'true' - image: ghcr.io/homarr-labs/homarr:1.0.0 + image: ghcr.io/homarr-labs/homarr@sha256:80ee593cd76afbbb34b8edb4b345281e2bf47d33e6d682684d6ad36624784ce0 imagePullPolicy: Always name: homarr ports: @@ -77,4 +70,3 @@ spec: - name: redis persistentVolumeClaim: claimName: homarr-redis-pvc - diff --git a/monitoring/deployment-uptime-kuma.yaml b/monitoring/deployment-uptime-kuma.yaml index e14baa2..85eac26 100644 --- a/monitoring/deployment-uptime-kuma.yaml +++ b/monitoring/deployment-uptime-kuma.yaml @@ -1,11 +1,6 @@ apiVersion: apps/v1 kind: Deployment metadata: - annotations: - deployment.kubernetes.io/revision: '2' - kubectl.kubernetes.io/last-applied-configuration: '{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{},"name":"uptime-kuma","namespace":"monitoring"},"spec":{"replicas":1,"selector":{"matchLabels":{"app":"uptime-kuma"}},"template":{"metadata":{"labels":{"app":"uptime-kuma"}},"spec":{"containers":[{"image":"louislam/uptime-kuma:1","name":"uptime-kuma","ports":[{"containerPort":3001}],"resources":{"limits":{"cpu":"300m","memory":"512Mi"},"requests":{"cpu":"50m","memory":"128Mi"}},"volumeMounts":[{"mountPath":"/app/data","name":"data"}]}],"volumes":[{"name":"data","persistentVolumeClaim":{"claimName":"uptime-kuma-pvc"}}]}}}} - - ' name: uptime-kuma namespace: monitoring spec: @@ -22,8 +17,6 @@ spec: type: RollingUpdate template: metadata: - annotations: - kubectl.kubernetes.io/restartedAt: '2026-04-09T20:22:58Z' labels: app: uptime-kuma spec: @@ -55,4 +48,3 @@ spec: - name: data persistentVolumeClaim: claimName: uptime-kuma-pvc -