atlas-botandClaude Opus 5.5
21a7583523
Comments that pointed at other YAML as `file.yaml:N` went stale on any edit above the cited line; three drift fixes had been merged by hand (REN-181). The cited block now carries `# anchor: <name>` and the comment cites `path.yaml#<name>`. - Sweep: all 32 line-number citations in YAML comments converted. Several were already stale at head and now point at the right block (see PR). Vendored files (Flux gotk-components, IMC CRD) get no anchor; those two citations name the object/schema path instead. - Guard: scripts/ci/yaml-citations.sh in ci-manifests-test.yml; fails on a line-number citation or a path#name whose file/anchor is gone. Self-test in ci-scripts-test.yml. - CONTRIBUTING.md: the convention in three lines. Comment-only under kubernetes/: every file parses to identical objects before and after, so Flux applies nothing and no ConfigMap data changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
131 lines
4.1 KiB
YAML
131 lines
4.1 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: navidrome-config
|
|
namespace: navidrome
|
|
data:
|
|
TZ: "Europe/Berlin"
|
|
ND_LOGLEVEL: "info"
|
|
ND_SCANNER_SCHEDULE: "0 * * * *"
|
|
ND_ENABLEINSIGHTSCOLLECTOR: "false"
|
|
# Identity from the navidrome-gate outpost. Traefik strips this header on
|
|
# the ungated /rest and /share routes.
|
|
#
|
|
# ND_EXTAUTH_TRUSTEDSOURCES BELOW IS NOT A NARROWING. fd10:244::/48 plus
|
|
# 10.244.0.0/16 is the entire cluster pod CIDR, so navidrome's own
|
|
# reverse-proxy trust check accepts X-Authentik-Username from ANY pod.
|
|
# The CiliumNetworkPolicy is the only real boundary, and it is wider than
|
|
# "the outpost and Traefik" — default-deny-ingress in
|
|
# kubernetes/infrastructure/network-policies/navidrome-ns.yaml uses
|
|
# `endpointSelector: {}` and admits, on every port:
|
|
# - the navidrome namespace, every port
|
|
# - traefik, every port
|
|
# - the navidrome-gate outpost, every port
|
|
# - the lidarr-gate outpost, every port - reaches navidrome too
|
|
# - host / remote-node, every port - the kubelet sources the HTTP probes
|
|
# from the host netns, so this one can never be removed while the pod
|
|
# has HTTP probes
|
|
# - blackbox-exporter on :4533 and :8686 only
|
|
# The whole-monitoring-namespace admit that used to be in this list was
|
|
# narrowed to blackbox-exporter on those two ports in REN-28. Rules are
|
|
# cited by what they admit, not by line number, so this list cannot go
|
|
# stale the next time that file is edited.
|
|
# The value stays at the pod CIDR ON PURPOSE - see REN-28. The address
|
|
# navidrome sees is the outpost's POD IP, which is not stable across
|
|
# reschedules, so a narrower literal here fails open-ended and silently
|
|
# the next time that pod moves. Tightening the CNP is the control that
|
|
# would actually do work.
|
|
ND_EXTAUTH_USERHEADER: "X-Authentik-Username"
|
|
ND_EXTAUTH_TRUSTEDSOURCES: "fd10:244::/48,10.244.0.0/16"
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: navidrome
|
|
namespace: navidrome
|
|
labels:
|
|
app.kubernetes.io/name: navidrome
|
|
annotations:
|
|
configmap.reloader.stakater.com/reload: navidrome-config
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: navidrome
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: navidrome
|
|
spec:
|
|
enableServiceLinks: false
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: navidrome
|
|
image: deluan/navidrome:0.64.2 # {"$imagepolicy": "flux-system:navidrome"}
|
|
ports:
|
|
- name: http
|
|
containerPort: 4533
|
|
envFrom:
|
|
- configMapRef:
|
|
name: navidrome-config
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /data
|
|
- name: music
|
|
mountPath: /music
|
|
readOnly: true
|
|
# anchor: kubelet-probes
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /ping
|
|
port: http
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
timeoutSeconds: 10
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /ping
|
|
port: http
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 1Gi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: navidrome-data
|
|
- name: music
|
|
persistentVolumeClaim:
|
|
claimName: navidrome-music-bulk
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: navidrome
|
|
namespace: navidrome
|
|
spec:
|
|
selector:
|
|
app.kubernetes.io/name: navidrome
|
|
ports:
|
|
- name: http
|
|
port: 80
|
|
targetPort: http
|