eblume/blumeops
1
1
Fork 0
Code Issues Pull requests Projects Releases 83 Packages Wiki Activity Actions

Add :kustomized sentinel tag to manifest images, review devpi

Browse source 
Bare image references in manifests were ambiguous — unclear whether the
tag was intentionally omitted or managed by kustomize. Add :kustomized
sentinel to all 37 image refs overridden by kustomize images transformer.
Add sync notes for tailscale-operator proxyclass (CRD fields not processed
by kustomize). Mark devpi reviewed (6.19.1 is current).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Erich Blume 2026-03-06 08:15:06 -08:00
commit 6e8d11c6bb
34 changed files with 44 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

2
argocd/manifests/alloy-k8s/daemonset.yaml
View file

@ -19,7 +19,7 @@ spec:
fsGroup: 473 # alloy user group fsGroup: 473 # alloy user group
containers: containers:
- name: alloy - name: alloy
image: grafana/alloy image: grafana/alloy:kustomized
args: args:
- run - run
- --server.http.listen-addr=0.0.0.0:12345 - --server.http.listen-addr=0.0.0.0:12345

2
argocd/manifests/alloy-ringtail/daemonset.yaml
View file

@ -19,7 +19,7 @@ spec:
fsGroup: 473 # alloy user group fsGroup: 473 # alloy user group
containers: containers:
- name: alloy - name: alloy
image: grafana/alloy image: grafana/alloy:kustomized
args: args:
- run - run
- --server.http.listen-addr=0.0.0.0:12345 - --server.http.listen-addr=0.0.0.0:12345

2
argocd/manifests/alloy-tracing-ringtail/daemonset.yaml
View file

@ -18,7 +18,7 @@ spec:
hostPID: true hostPID: true
containers: containers:
- name: alloy - name: alloy
image: grafana/alloy image: grafana/alloy:kustomized
args: args:
- run - run
- --server.http.listen-addr=0.0.0.0:12346 - --server.http.listen-addr=0.0.0.0:12346

2
argocd/manifests/authentik/deployment-redis.yaml
View file

@ -18,7 +18,7 @@ spec:
spec: spec:
containers: containers:
- name: redis - name: redis
image: docker.io/library/redis image: docker.io/library/redis:kustomized
ports: ports:
- name: redis - name: redis
containerPort: 6379 containerPort: 6379

2
argocd/manifests/authentik/deployment-server.yaml
View file

@ -18,7 +18,7 @@ spec:
spec: spec:
containers: containers:
- name: server - name: server
image: registry.ops.eblu.me/blumeops/authentik image: registry.ops.eblu.me/blumeops/authentik:kustomized
args: ["server"] args: ["server"]
ports: ports:
- name: http - name: http

2
argocd/manifests/authentik/deployment-worker.yaml
View file

@ -18,7 +18,7 @@ spec:
spec: spec:
containers: containers:
- name: worker - name: worker
image: registry.ops.eblu.me/blumeops/authentik image: registry.ops.eblu.me/blumeops/authentik:kustomized
args: ["worker"] args: ["worker"]
env: env:
- name: AUTHENTIK_SECRET_KEY - name: AUTHENTIK_SECRET_KEY

2
argocd/manifests/cv/deployment.yaml
View file

@ -21,7 +21,7 @@ spec:
spec: spec:
containers: containers:
- name: cv - name: cv
image: registry.ops.eblu.me/blumeops/cv image: registry.ops.eblu.me/blumeops/cv:kustomized
ports: ports:
- containerPort: 80 - containerPort: 80
name: http name: http

2
argocd/manifests/devpi/statefulset.yaml
View file

@ -18,7 +18,7 @@ spec:
fsGroup: 1000 fsGroup: 1000
containers: containers:
- name: devpi - name: devpi
image: registry.ops.eblu.me/blumeops/devpi image: registry.ops.eblu.me/blumeops/devpi:kustomized
env: env:
- name: DEVPI_ROOT_PASSWORD - name: DEVPI_ROOT_PASSWORD
valueFrom: valueFrom:

2
argocd/manifests/docs/deployment.yaml
View file

@ -21,7 +21,7 @@ spec:
spec: spec:
containers: containers:
- name: docs - name: docs
image: registry.ops.eblu.me/blumeops/quartz image: registry.ops.eblu.me/blumeops/quartz:kustomized
ports: ports:
- containerPort: 80 - containerPort: 80
name: http name: http

4
argocd/manifests/forgejo-runner/deployment.yaml
View file

@ -18,7 +18,7 @@ spec:
containers: containers:
# Forgejo runner daemon # Forgejo runner daemon
- name: runner - name: runner
image: code.forgejo.org/forgejo/runner image: code.forgejo.org/forgejo/runner:kustomized
env: env:
- name: TZ - name: TZ
value: America/Los_Angeles value: America/Los_Angeles
@ -68,7 +68,7 @@ spec:
# Docker-in-Docker sidecar # Docker-in-Docker sidecar
- name: dind - name: dind
image: docker image: docker:kustomized
securityContext: securityContext:
privileged: true privileged: true
env: env:

2
argocd/manifests/frigate/deployment-notify.yaml
View file

@ -16,7 +16,7 @@ spec:
spec: spec:
containers: containers:
- name: frigate-notify - name: frigate-notify
image: ghcr.io/0x2142/frigate-notify image: ghcr.io/0x2142/frigate-notify:kustomized
env: env:
- name: TZ - name: TZ
value: America/Los_Angeles value: America/Los_Angeles

4
argocd/manifests/frigate/deployment.yaml
View file

@ -19,7 +19,7 @@ spec:
runtimeClassName: nvidia runtimeClassName: nvidia
initContainers: initContainers:
- name: copy-config - name: copy-config
image: busybox image: busybox:kustomized
command: ["cp", "/config-ro/config.yml", "/config/config.yml"] command: ["cp", "/config-ro/config.yml", "/config/config.yml"]
volumeMounts: volumeMounts:
- name: config-ro - name: config-ro
@ -28,7 +28,7 @@ spec:
mountPath: /config mountPath: /config
containers: containers:
- name: frigate - name: frigate
image: ghcr.io/blakeblackshear/frigate image: ghcr.io/blakeblackshear/frigate:kustomized
ports: ports:
- containerPort: 5000 - containerPort: 5000
name: http name: http

6
argocd/manifests/grafana/deployment.yaml
View file

@ -32,7 +32,7 @@ spec:
runAsUser: 472 runAsUser: 472
initContainers: initContainers:
- name: init-chown-data - name: init-chown-data
image: docker.io/library/busybox image: docker.io/library/busybox:kustomized
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
command: ["chown", "-R", "472:472", "/var/lib/grafana"] command: ["chown", "-R", "472:472", "/var/lib/grafana"]
securityContext: securityContext:
@ -48,7 +48,7 @@ spec:
containers: containers:
# Dashboard sidecar - watches ConfigMaps with grafana_dashboard=1 # Dashboard sidecar - watches ConfigMaps with grafana_dashboard=1
- name: grafana-sc-dashboard - name: grafana-sc-dashboard
image: registry.ops.eblu.me/blumeops/grafana-sidecar image: registry.ops.eblu.me/blumeops/grafana-sidecar:kustomized
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
env: env:
- name: METHOD - name: METHOD
@ -88,7 +88,7 @@ spec:
mountPath: /tmp/dashboards mountPath: /tmp/dashboards
# Grafana # Grafana
- name: grafana - name: grafana
image: registry.ops.eblu.me/blumeops/grafana image: registry.ops.eblu.me/blumeops/grafana:kustomized
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
env: env:
- name: POD_IP - name: POD_IP

2
argocd/manifests/homepage/deployment.yaml
View file

@ -20,7 +20,7 @@ spec:
fsGroup: 1000 fsGroup: 1000
containers: containers:
- name: homepage - name: homepage
image: registry.ops.eblu.me/blumeops/homepage image: registry.ops.eblu.me/blumeops/homepage:kustomized
securityContext: securityContext:
runAsNonRoot: true runAsNonRoot: true
allowPrivilegeEscalation: false allowPrivilegeEscalation: false

2
argocd/manifests/kiwix/cronjob-zim-watcher.yaml
View file

@ -15,7 +15,7 @@ spec:
serviceAccountName: zim-watcher serviceAccountName: zim-watcher
containers: containers:
- name: watcher - name: watcher
image: registry.ops.eblu.me/blumeops/kubectl image: registry.ops.eblu.me/blumeops/kubectl:kustomized
command: ["/bin/bash", "-c"] command: ["/bin/bash", "-c"]
args: args:
- | - |

4
argocd/manifests/kiwix/deployment.yaml
View file

@ -20,7 +20,7 @@ spec:
containers: containers:
# Main kiwix-serve container # Main kiwix-serve container
- name: kiwix-serve - name: kiwix-serve
image: registry.ops.eblu.me/blumeops/kiwix-serve image: registry.ops.eblu.me/blumeops/kiwix-serve:kustomized
args: args:
- "/bin/sh" - "/bin/sh"
- "-c" - "-c"
@ -53,7 +53,7 @@ spec:
# Sidecar: Syncs declarative ZIM torrents to transmission # Sidecar: Syncs declarative ZIM torrents to transmission
- name: torrent-sync - name: torrent-sync
image: registry.ops.eblu.me/blumeops/transmission image: registry.ops.eblu.me/blumeops/transmission:kustomized
command: ["/bin/bash", "-c"] command: ["/bin/bash", "-c"]
args: args:
- | - |

2
argocd/manifests/kube-state-metrics-ringtail/deployment.yaml
View file

@ -18,7 +18,7 @@ spec:
serviceAccountName: kube-state-metrics serviceAccountName: kube-state-metrics
containers: containers:
- name: kube-state-metrics - name: kube-state-metrics
image: registry.k8s.io/kube-state-metrics/kube-state-metrics image: registry.k8s.io/kube-state-metrics/kube-state-metrics:kustomized
ports: ports:
- containerPort: 8080 - containerPort: 8080
name: http-metrics name: http-metrics

2
argocd/manifests/kube-state-metrics/deployment.yaml
View file

@ -18,7 +18,7 @@ spec:
serviceAccountName: kube-state-metrics serviceAccountName: kube-state-metrics
containers: containers:
- name: kube-state-metrics - name: kube-state-metrics
image: registry.k8s.io/kube-state-metrics/kube-state-metrics image: registry.k8s.io/kube-state-metrics/kube-state-metrics:kustomized
ports: ports:
- containerPort: 8080 - containerPort: 8080
name: http-metrics name: http-metrics

2
argocd/manifests/loki/statefulset.yaml
View file

@ -20,7 +20,7 @@ spec:
runAsUser: 10001 runAsUser: 10001
containers: containers:
- name: loki - name: loki
image: grafana/loki image: grafana/loki:kustomized
args: args:
- -config.file=/etc/loki/loki-config.yaml - -config.file=/etc/loki/loki-config.yaml
ports: ports:

2
argocd/manifests/miniflux/deployment.yaml
View file

@ -15,7 +15,7 @@ spec:
spec: spec:
containers: containers:
- name: miniflux - name: miniflux
image: registry.ops.eblu.me/blumeops/miniflux image: registry.ops.eblu.me/blumeops/miniflux:kustomized
ports: ports:
- containerPort: 8080 - containerPort: 8080
env: env:

2
argocd/manifests/mosquitto/deployment.yaml
View file

@ -16,7 +16,7 @@ spec:
spec: spec:
containers: containers:
- name: mosquitto - name: mosquitto
image: eclipse-mosquitto image: eclipse-mosquitto:kustomized
ports: ports:
- containerPort: 1883 - containerPort: 1883
name: mqtt name: mqtt

2
argocd/manifests/navidrome/deployment.yaml
View file

@ -20,7 +20,7 @@ spec:
fsGroup: 1000 fsGroup: 1000
containers: containers:
- name: navidrome - name: navidrome
image: registry.ops.eblu.me/blumeops/navidrome image: registry.ops.eblu.me/blumeops/navidrome:kustomized
securityContext: securityContext:
runAsNonRoot: true runAsNonRoot: true
allowPrivilegeEscalation: false allowPrivilegeEscalation: false

2
argocd/manifests/ntfy/deployment.yaml
View file

@ -16,7 +16,7 @@ spec:
spec: spec:
containers: containers:
- name: ntfy - name: ntfy
image: registry.ops.eblu.me/blumeops/ntfy image: registry.ops.eblu.me/blumeops/ntfy:kustomized
args: ["serve", "--config", "/etc/ntfy/server.yml"] args: ["serve", "--config", "/etc/ntfy/server.yml"]
ports: ports:
- containerPort: 80 - containerPort: 80

2
argocd/manifests/nvidia-device-plugin/daemonset.yaml
View file

@ -22,7 +22,7 @@ spec:
priorityClassName: system-node-critical priorityClassName: system-node-critical
containers: containers:
- name: nvidia-device-plugin - name: nvidia-device-plugin
image: nvcr.io/nvidia/k8s-device-plugin image: nvcr.io/nvidia/k8s-device-plugin:kustomized
args: args:
- --device-id-strategy=index - --device-id-strategy=index
- --config-file=/config/config.yaml - --config-file=/config/config.yaml

4
argocd/manifests/ollama/deployment.yaml
View file

@ -19,7 +19,7 @@ spec:
runtimeClassName: nvidia runtimeClassName: nvidia
containers: containers:
- name: ollama - name: ollama
image: ollama/ollama image: ollama/ollama:kustomized
ports: ports:
- containerPort: 11434 - containerPort: 11434
name: http name: http
@ -56,7 +56,7 @@ spec:
initialDelaySeconds: 10 initialDelaySeconds: 10
periodSeconds: 10 periodSeconds: 10
- name: model-sync - name: model-sync
image: ollama/ollama image: ollama/ollama:kustomized
command: ["/bin/bash", "/scripts/sync-models.sh"] command: ["/bin/bash", "/scripts/sync-models.sh"]
env: env:
- name: MODEL_LIST - name: MODEL_LIST

2
argocd/manifests/prometheus/statefulset.yaml
View file

@ -20,7 +20,7 @@ spec:
runAsUser: 65534 runAsUser: 65534
containers: containers:
- name: prometheus - name: prometheus
image: registry.ops.eblu.me/blumeops/prometheus image: registry.ops.eblu.me/blumeops/prometheus:kustomized
args: args:
- --config.file=/etc/prometheus/prometheus.yml - --config.file=/etc/prometheus/prometheus.yml
- --storage.tsdb.path=/prometheus - --storage.tsdb.path=/prometheus

4
argocd/manifests/tailscale-operator-base/kustomization.yaml
View file

@ -9,6 +9,10 @@ resources:
- proxyclass.yaml - proxyclass.yaml
- dnsconfig.yaml - dnsconfig.yaml
# NOTE: also update proxyclass.yaml when changing the Tailscale version.
# The kustomize images transformer only processes standard k8s container specs
# (Deployments, StatefulSets, etc.), not CRD fields like ProxyClass, so
# proxyclass.yaml tags must be updated manually.
images: images:
- name: docker.io/tailscale/k8s-operator - name: docker.io/tailscale/k8s-operator
newTag: v1.94.2 newTag: v1.94.2

2
argocd/manifests/tailscale-operator-base/operator.yaml
View file

@ -5362,7 +5362,7 @@ spec:
valueFrom: valueFrom:
fieldRef: fieldRef:
fieldPath: metadata.uid fieldPath: metadata.uid
image: docker.io/tailscale/k8s-operator image: docker.io/tailscale/k8s-operator:kustomized
imagePullPolicy: Always imagePullPolicy: Always
name: operator name: operator
volumeMounts: volumeMounts:

1
argocd/manifests/tailscale-operator-base/proxyclass.yaml
View file

@ -18,6 +18,7 @@ spec:
statefulSet: statefulSet:
pod: pod:
tailscaleContainer: tailscaleContainer:
# NOTE: keep in sync with kustomization.yaml (CRD fields aren't processed by kustomize images)
image: docker.io/tailscale/tailscale:v1.94.2 image: docker.io/tailscale/tailscale:v1.94.2
tailscaleInitContainer: tailscaleInitContainer:
image: docker.io/tailscale/tailscale:v1.94.2 image: docker.io/tailscale/tailscale:v1.94.2

2
argocd/manifests/tempo/statefulset.yaml
View file

@ -20,7 +20,7 @@ spec:
runAsUser: 10001 runAsUser: 10001
containers: containers:
- name: tempo - name: tempo
image: grafana/tempo image: grafana/tempo:kustomized
args: args:
- -config.file=/etc/tempo/tempo.yaml - -config.file=/etc/tempo/tempo.yaml
ports: ports:

2
argocd/manifests/teslamate/deployment.yaml
View file

@ -15,7 +15,7 @@ spec:
spec: spec:
containers: containers:
- name: teslamate - name: teslamate
image: registry.ops.eblu.me/blumeops/teslamate image: registry.ops.eblu.me/blumeops/teslamate:kustomized
ports: ports:
- containerPort: 4000 - containerPort: 4000
env: env:

4
argocd/manifests/torrent/deployment.yaml
View file

@ -16,7 +16,7 @@ spec:
spec: spec:
containers: containers:
- name: transmission - name: transmission
image: registry.ops.eblu.me/blumeops/transmission image: registry.ops.eblu.me/blumeops/transmission:kustomized
env: env:
- name: PUID - name: PUID
value: "1000" value: "1000"
@ -56,7 +56,7 @@ spec:
initialDelaySeconds: 10 initialDelaySeconds: 10
periodSeconds: 10 periodSeconds: 10
- name: transmission-exporter - name: transmission-exporter
image: registry.ops.eblu.me/blumeops/transmission-exporter image: registry.ops.eblu.me/blumeops/transmission-exporter:kustomized
env: env:
- name: TRANSMISSION_ADDR - name: TRANSMISSION_ADDR
value: "http://localhost:9091" value: "http://localhost:9091"

1
docs/changelog.d/+kustomized-image-tags.infra.md Normal file
View file

@ -0,0 +1 @@
Add `:kustomized` sentinel tag to all manifest image references overridden by kustomize, making it clear the real tag lives in kustomization.yaml.

2
service-versions.yaml
View file

@ -201,7 +201,7 @@ services:
- name: devpi - name: devpi
type: argocd type: argocd
last-reviewed: null last-reviewed: 2026-03-06
current-version: "6.19.1" current-version: "6.19.1"
upstream-source: https://github.com/devpi/devpi/releases upstream-source: https://github.com/devpi/devpi/releases