jakman85andClaude Opus 4.8
d24a443c7d
Migrate image.toolkit.fluxcd.io/v1beta2 -> /v1 for ImageRepository,
ImagePolicy, and ImageUpdateAutomation ahead of the Flux v2.7+ upgrade
(cluster-upgrade-plan §3.2). Flux v2.4 (current) already serves /v1, so
migrating the manifests now is a safe no-op at runtime.
- catalog/render.py: r_image_automation emits v1 for ImageRepository/ImagePolicy
- platform/image-automation/{image-update-automation,per-service/pihole.example}
- conformance L3 hands-off-update chainsaw applies v1 CRs
- conformance L1 goldens re-rendered to match (apiVersion-only diff)
No spec-field changes required: all spec fields used (image, interval,
imageRepositoryRef, filterTags.pattern/extract, policy.semver.range,
sourceRef, git.*, update.strategy/path) are unchanged in v1; the v1
messageTemplate already uses .Changed (not the removed .Updated).
apps/ golden unaffected (canonical render uses --no-image-automation).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
120 lines
2.6 KiB
YAML
120 lines
2.6 KiB
YAML
---
|
|
# Namespace (trust zone; default-deny + policies apply)
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: baseline-demo
|
|
labels:
|
|
homelab.keithjackson.dev/app-namespace: 'true'
|
|
---
|
|
# Default-deny baseline (R-NET-01): deny all, allow only DNS
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: default-deny
|
|
namespace: baseline-demo
|
|
labels:
|
|
homelab.keithjackson.dev/baseline: default-deny
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress: []
|
|
egress:
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
---
|
|
# Deployment (R-PLAT-02)
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: baseline-demo
|
|
namespace: baseline-demo
|
|
labels:
|
|
app.kubernetes.io/name: baseline-demo
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: baseline-demo
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: baseline-demo
|
|
homelab.keithjackson.dev/egress-class: internet
|
|
homelab.keithjackson.dev/auth-mode: none
|
|
spec:
|
|
containers:
|
|
- name: baseline-demo
|
|
image: nginx:1.27
|
|
---
|
|
# CiliumNetworkPolicy world egress allow (egress class governs the path; R-NET-05): baseline-demo-allow-internet-egress
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: baseline-demo-allow-internet-egress
|
|
namespace: baseline-demo
|
|
labels:
|
|
app.kubernetes.io/name: baseline-demo
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: baseline-demo
|
|
egress:
|
|
- toEntities:
|
|
- world
|
|
---
|
|
# ServiceMonitor (R-OBS-01)
|
|
apiVersion: monitoring.coreos.com/v1
|
|
kind: ServiceMonitor
|
|
metadata:
|
|
name: baseline-demo
|
|
namespace: baseline-demo
|
|
labels:
|
|
release: kube-prometheus-stack
|
|
app.kubernetes.io/name: baseline-demo
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: baseline-demo
|
|
namespaceSelector:
|
|
matchNames:
|
|
- baseline-demo
|
|
endpoints:
|
|
- port: metrics
|
|
interval: 30s
|
|
---
|
|
# Flux ImageRepository (R-UPD)
|
|
apiVersion: image.toolkit.fluxcd.io/v1
|
|
kind: ImageRepository
|
|
metadata:
|
|
name: baseline-demo
|
|
namespace: baseline-demo
|
|
spec:
|
|
image: nginx
|
|
interval: 1h0m0s
|
|
---
|
|
# Flux ImagePolicy (R-UPD)
|
|
apiVersion: image.toolkit.fluxcd.io/v1
|
|
kind: ImagePolicy
|
|
metadata:
|
|
name: baseline-demo
|
|
namespace: baseline-demo
|
|
annotations:
|
|
homelab.keithjackson.dev/update-channel: stable
|
|
homelab.keithjackson.dev/auto-rollback: 'true'
|
|
spec:
|
|
imageRepositoryRef:
|
|
name: baseline-demo
|
|
policy:
|
|
semver:
|
|
range: '>=0.0.0'
|