chore(deps): update helm release cert-manager to v1.21.3 (#331 )

chore(deps): update helm release external-secrets to v2.14.0 (#330 )
chore(deps): update postgres:18.6-alpine docker digest to 10a5c69 (#329 )
2026-10-26 21:10:29 +00:00 · 2026-10-26 17:10:52 +00:00 · 2026-10-26 04:15:29 +00:00 · 2026-10-25 15:10:24 +00:00 · 2026-10-24 14:10:07 +00:00 · 2026-10-24 13:10:37 +00:00
13 changed files with 189 additions and 202 deletions
@@ -1,2 +1,3 @@
 data
 charts
 .claude/settings.local.json
@@ -29,8 +29,8 @@ spec:
  dnsNames:
  - shiny
  - auth0
-  - staging-shiny.unbound.se
+  - shiny.local.unbound.se
-  - staging-shiny-api.unbound.se
+  - shiny-api.local.unbound.se
  secretName: self-signed-cert-tls
  issuerRef:
    name: self-signed
@@ -2,7 +2,7 @@
 # Proxies traffic from KinD cluster to host machine for local development
 #
 # Add to /etc/hosts:
-#   192.168.228.2 staging-shiny.unbound.se staging-shiny-api.unbound.se
+#   192.168.228.2 shiny.local.unbound.se shiny-api.local.unbound.se
 #
 # Apply with: kubectl apply -f local-proxy.yaml
 # Delete with: kubectl delete -f local-proxy.yaml
@@ -24,15 +24,15 @@ kind: Ingress
 metadata:
  name: frontend
  annotations:
-    nginx.ingress.kubernetes.io/upstream-vhost: "localhost:3300"
+    traefik.ingress.kubernetes.io/router.middlewares: default-frontend-host@kubernetescrd
 spec:
-  ingressClassName: nginx
+  ingressClassName: traefik
  tls:
    - hosts:
-        - staging-shiny.unbound.se
+        - shiny.local.unbound.se
      secretName: self-signed-cert-tls
  rules:
-    - host: staging-shiny.unbound.se
+    - host: shiny.local.unbound.se
      http:
        paths:
          - path: /
@@ -59,15 +59,15 @@ kind: Ingress
 metadata:
  name: api
  annotations:
-    nginx.ingress.kubernetes.io/upstream-vhost: "localhost:4444"
+    traefik.ingress.kubernetes.io/router.middlewares: default-api-host@kubernetescrd
 spec:
-  ingressClassName: nginx
+  ingressClassName: traefik
  tls:
    - hosts:
-        - staging-shiny-api.unbound.se
+        - shiny-api.local.unbound.se
      secretName: self-signed-cert-tls
  rules:
-    - host: staging-shiny-api.unbound.se
+    - host: shiny-api.local.unbound.se
      http:
        paths:
          - path: /
@@ -77,3 +77,21 @@ spec:
                name: api-external
                port:
                  number: 4444
 ---
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: frontend-host
 spec:
  headers:
    customRequestHeaders:
      Host: "localhost:3300"
 ---
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: api-host
 spec:
  headers:
    customRequestHeaders:
      Host: "localhost:4444"
@@ -33,6 +33,6 @@ spec:
      - key: "rds/postgres/prod-psql"
        value: '{"POSTGRES_URL": "postgres://postgres:postgres@postgres:5432/postgres?sslmode=disable", "DB_HOST": "postgres", "DB_NAME": "postgres", "DB_PASSWORD": "postgres", "DB_PORT": "5432", "DB_USERNAME": "postgres"}'
      - key: "mq/rabbit/prod"
-        value: '{"AMQP_URL": "amqp://user:password@rabbitmq:5672/"}'
+        value: '{"AMQP_URL": "amqp://guest:guest@lavinmq:5672/"}'
      - key: "services/schemas"
        value: '{"ISSUER": "auth0", "STRICT_SSL": "false"}'
@@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - postgres.yaml
- rabbitmq.yaml
+- lavinmq.yaml
 - namespaces.yaml
 helmCharts:
 - name: external-secrets
@@ -10,13 +10,13 @@ helmCharts:
  includeCRDs: true
  releaseName: external-secrets
  repo: https://charts.external-secrets.io
-  version: 2.0.1
+  version: 2.14.0
 - name: cert-manager
  namespace: cert-manager
  includeCRDs: true
  releaseName: cert-manager
  repo: https://charts.jetstack.io
-  version: v1.19.4
+  version: v1.21.3
  valuesInline:
    crds:
      enabled: true
@@ -0,0 +1,100 @@
 apiVersion: v1
 kind: Secret
 metadata:
  name: lavinmq
 stringData:
  AMQP_URL: "amqp://guest:guest@lavinmq:5672/"
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  labels:
    app.kubernetes.io/name: lavinmq
    release: lavinmq
  name: lavinmq
 spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: lavinmq
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: lavinmq
    spec:
      containers:
      - image: cloudamqp/lavinmq:2.10.3@sha256:24f17edb92771504aa29db4c610b5882e36e57aa5e6aa8198451efbd7e59be44
        imagePullPolicy: Always
        livenessProbe:
          tcpSocket:
            port: 5672
          failureThreshold: 6
          initialDelaySeconds: 30
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        name: lavinmq
        ports:
        - containerPort: 5672
          name: amqp
          protocol: TCP
        - containerPort: 15672
          name: stats
          protocol: TCP
        readinessProbe:
          httpGet:
            port: 15672
            path: /api/whoami
            httpHeaders:
            - name: "Authorization"
              value: "Basic Z3Vlc3Q6Z3Vlc3Q="
          failureThreshold: 3
          initialDelaySeconds: 10
          periodSeconds: 5
          successThreshold: 1
          timeoutSeconds: 3
        resources:
          requests:
            cpu: 100m
            memory: 256Mi
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - name: data
          mountPath: /var/lib/lavinmq
      volumes:
      - name: data
        hostPath:
          path: /data/lavinmq
      dnsPolicy: ClusterFirst
      restartPolicy: Always
 ---
 apiVersion: v1
 kind: Service
 metadata:
  labels:
    app.kubernetes.io/name: lavinmq
    release: lavinmq
  name: lavinmq
 spec:
  externalTrafficPolicy: Cluster
  ports:
  - name: amqp
    nodePort: 5672
    port: 5672
    protocol: TCP
    targetPort: amqp
  - name: stats
    nodePort: 15672
    port: 15672
    protocol: TCP
    targetPort: stats
  selector:
    app.kubernetes.io/name: lavinmq
  sessionAffinity: None
  type: NodePort
@@ -23,6 +23,7 @@ data:
    	CREATE DATABASE authz WITH OWNER postgres ENCODING utf8;
    	CREATE DATABASE company WITH OWNER postgres ENCODING utf8;
    	CREATE DATABASE consumer WITH OWNER postgres ENCODING utf8;
    	CREATE DATABASE document WITH OWNER postgres ENCODING utf8;
    	CREATE DATABASE employee WITH OWNER postgres ENCODING utf8;
    	CREATE DATABASE invoice WITH OWNER postgres ENCODING utf8;
    	CREATE DATABASE notification WITH OWNER postgres ENCODING utf8;
@@ -52,7 +53,7 @@ spec:
    spec:
      containers:
      - name: postgres
-        image: postgres:18.2-alpine@sha256:035b9ab53cfa147d7202b61f5f7782b939ae815b7d6bc81c96b7b42ff1fca950
+        image: postgres:18.6-alpine@sha256:10a5c69a83035ab5239f5620d708520e8b28f5aa1f2b20143e6024532edadfb5
        args:
        - -c
        - shared_buffers=384MB
@@ -62,8 +63,6 @@ spec:
        resources:
          requests:
            memory: 400Mi
          limits:
            memory: 600Mi
        ports:
        - containerPort: 5432
        env:
@@ -1,166 +0,0 @@
 kind: ConfigMap
 apiVersion: v1
 metadata:
  name: shared-rabbitmq
 data:
  RABBITMQ_SERVERS: rabbitmq
  RABBITMQ_VHOST: /
  RABBITMQ_USERNAME: user
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: rabbitmq-env-config
 data:
  memory.conf: |-
    total_memory_available_override_value = 1GB
 ---
 apiVersion: v1
 kind: Secret
 metadata:
  name: rabbitmq
 stringData:
  AMQP_URL: "amqp://user:password@rabbitmq:5672/"
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  labels:
    app.kubernetes.io/name: rabbitmq
    release: rabbitmq
  name: rabbitmq
 spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: rabbitmq
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: rabbitmq
    spec:
      securityContext:
        fsGroup: 999
        runAsUser: 999
        runAsGroup: 999
      containers:
      - env:
        - name: RABBITMQ_DEFAULT_USER
          value: user
        - name: RABBITMQ_DEFAULT_PASS
          value: password
        - name: RABBITMQ_NODE_PORT_NUMBER
          value: "5672"
        - name: RABBITMQ_NODE_TYPE
          value: stats
        - name: RABBITMQ_NODENAME
          value: rabbit@localhost
        - name: RABBITMQ_CLUSTER_NODE_NAME
        - name: RABBITMQ_DEFAULT_VHOST
          value: /
        - name: RABBITMQ_MANAGER_PORT_NUMBER
          value: "15672"
        - name: RABBITMQ_DISK_FREE_LIMIT
          value: '"8GiB"'
        - name: RABBITMQ_CONFIG_FILES
          value: /etc/rabbitmq/conf.d
        image: rabbitmq:4.2.4-management@sha256:ae4a4628f132397d1290c9be38bec1eb4befd262cc9b4cee51d5706cce6c4314
        imagePullPolicy: Always
        livenessProbe:
          exec:
            command:
            - rabbitmqctl
            - status
          failureThreshold: 6
          initialDelaySeconds: 120
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        name: rabbitmq
        ports:
        - containerPort: 4369
          name: epmd
          protocol: TCP
        - containerPort: 5672
          name: amqp
          protocol: TCP
        - containerPort: 25672
          name: dist
          protocol: TCP
        - containerPort: 15672
          name: stats
          protocol: TCP
        readinessProbe:
          httpGet:
            port: 15672
            path: /api/aliveness-test/%2F
            httpHeaders:
            - name: "Authorization"
              value: "Basic dXNlcjpwYXNzd29yZA=="
          failureThreshold: 3
          initialDelaySeconds: 10
          periodSeconds: 5
          successThreshold: 1
          timeoutSeconds: 3
        resources:
          requests:
            cpu: 100m
            memory: 256Mi
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - name: data
          mountPath: /var/lib/rabbitmq
        - name: config
          mountPath: /etc/rabbitmq/conf.d/20-memory.conf
          subPath: memory.conf
          readOnly: true
      volumes:
      - name: data
        hostPath:
          path: /data/rabbitmq
      - name: config
        configMap:
          name: rabbitmq-env-config
      dnsPolicy: ClusterFirst
      restartPolicy: Always
 ---
 apiVersion: v1
 kind: Service
 metadata:
  labels:
    app.kubernetes.io/name: rabbitmq
    release: rabbitmq
  name: rabbitmq
 spec:
  externalTrafficPolicy: Cluster
  ports:
  - name: epmd
    nodePort: 31799
    port: 4369
    protocol: TCP
    targetPort: epmd
  - name: amqp
    nodePort: 5672
    port: 5672
    protocol: TCP
    targetPort: amqp
  - name: dist
    nodePort: 32687
    port: 25672
    protocol: TCP
    targetPort: dist
  - name: stats
    nodePort: 15672
    port: 15672
    protocol: TCP
    targetPort: stats
  selector:
    app.kubernetes.io/name: rabbitmq
  sessionAffinity: None
  type: NodePort
@@ -1,12 +0,0 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - namespaces.yaml
 helmCharts:
 - name: ingress-nginx
  namespace: ingress-nginx
  includeCRDs: true
  releaseName: ingress-nginx
  repo: https://kubernetes.github.io/ingress-nginx
  version: 4.14.3
  valuesFile: https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/hack/manifest-templates/provider/kind/values.yaml
@@ -0,0 +1,12 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - namespaces.yaml
 helmCharts:
 - name: traefik
  namespace: traefik
  includeCRDs: true
  releaseName: traefik
  repo: https://traefik.github.io/charts
  version: 42.1.3
  valuesFile: values.yaml
@@ -0,0 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: traefik
@@ -0,0 +1,31 @@
 deployment:
  kind: DaemonSet
 ports:
  web:
    hostPort: 80
  websecure:
    hostPort: 443
 tolerations:
  - key: "node-role.kubernetes.io/master"
    operator: "Equal"
    effect: "NoSchedule"
  - key: "node-role.kubernetes.io/control-plane"
    operator: "Equal"
    effect: "NoSchedule"
 nodeSelector:
  ingress-ready: "true"
 providers:
  kubernetesIngress:
    publishedService:
      enabled: false
 service:
  type: ClusterIP
 ingressClass:
  enabled: true
  isDefaultClass: true
@@ -12,20 +12,20 @@ kubectl create secret docker-registry gitlab \
 kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "gitlab"}]}'
-kustomized="$(mktemp -t unboundnginx.yaml.XXXXXX)"
+kustomized="$(mktemp -t unboundtraefik.yaml.XXXXXX)"
-kubectl kustomize --enable-helm "k8s/nginx" >> "${kustomized}"
+kubectl kustomize --enable-helm "k8s/traefik" >> "${kustomized}"
 kubectl apply -f "${kustomized}" --server-side || true
-printf "\nWait for pod app.kubernetes.io/component=controller to be created."
+printf "\nWait for pod app.kubernetes.io/name=traefik to be created."
 while :; do
  sleep 2
-  [ -n "$(kubectl -n ingress-nginx get pod --selector=app.kubernetes.io/component=controller 2>/dev/null)" ] && printf "\n\n" && break
+  [ -n "$(kubectl -n traefik get pod --selector=app.kubernetes.io/name=traefik 2>/dev/null)" ] && printf "\n\n" && break
  printf "."
 done
-echo "Wait for nginx to be available."
+echo "Wait for traefik to be available."
-until [[ $(kubectl -n ingress-nginx get endpointslices -l 'kubernetes.io/service-name=ingress-nginx-controller' -o=jsonpath='{.items[*].endpoints[*].addresses[*]}') ]]; do sleep 5; done
+until [[ $(kubectl -n traefik get endpointslices -l 'kubernetes.io/service-name=traefik' -o=jsonpath='{.items[*].endpoints[*].addresses[*]}') ]]; do sleep 5; done
 kustomized="$(mktemp -t unboundinfra.yaml.XXXXXX)"